From e166c11da96be1a62c57d7c9778a1b6349a41938 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:33:56 +0000 Subject: [PATCH 01/33] build: prototype a signed x86 Windows VM runtime bundle --- .../2026-09-26-vm-runtime/bundle.json | 11 ++ .../gtk-interactive-probe.ps1 | 36 +++++ .../gtk-session0-probe.ps1 | 33 ++++ .../2026-09-26-vm-runtime/gtk-task.ps1 | 10 ++ .../2026-09-26-vm-runtime/runtime-probe.ps1 | 41 +++++ .../windows-gtk-interactive.log | 136 ++++++++++++++++ .../windows-gtk-session0.log | 82 ++++++++++ .../2026-09-26-vm-runtime/windows-tcg.log | 16 ++ .../windows-vm-runtime-2026-09-26.md | 78 ++++++++++ packaging/build-vm-runtime.py | 145 ++++++++++++++++++ packaging/qemu-windows-source.json | 7 + tests/unit/test_vm_runtime_bundle.py | 81 ++++++++++ 12 files changed, 676 insertions(+) create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/gtk-interactive-probe.ps1 create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/gtk-session0-probe.ps1 create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/gtk-task.ps1 create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/runtime-probe.ps1 create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-interactive.log create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-session0.log create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/windows-tcg.log create mode 100644 docs/experiments/windows-vm-runtime-2026-09-26.md create mode 100644 packaging/build-vm-runtime.py create mode 100644 packaging/qemu-windows-source.json create mode 100644 tests/unit/test_vm_runtime_bundle.py diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json b/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json new file mode 100644 index 00000000..ad42cdb8 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json @@ -0,0 +1,11 @@ +{ + "bytes": 183295958, + "sha256": "7b40edf55a7686cd6e59088432717e3c5293b2378d115c671d922da7c97e869b", + "runtime_bytes": 321059722, + "manifest_files": 3282, + "manifest_bytes": 398147, + "helper_commit": "4f9985d", + "helper_account_outcome": "image-default", + "public_key": "def3840b56c1553b4a4de45f995fa007e30f9ff5763007e142ab924fbaefe661", + "scope": "Experimental local packaging. No runtime release or full Linux desktop verdict." +} diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-interactive-probe.ps1 b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-interactive-probe.ps1 new file mode 100644 index 00000000..7c57c756 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-interactive-probe.ps1 @@ -0,0 +1,36 @@ +Start-Transcript -Path 'C:\Windows\Temp\wootc-runtime-bundle-probe\gtk-interactive-transcript.log' -Force | Out-Null +$ErrorActionPreference = 'Stop' +$dir = 'C:\Windows\Temp\wootc-runtime-bundle-probe' +$qemu = "$dir\qemu\qemu-system-x86_64.exe" +$env:PATH = "$dir\qemu;C:\Windows\System32;C:\Windows" +$env:TEMP = $dir +$env:TMP = $dir +$env:HOME = $dir +foreach ($name in @('GTK_PATH','GTK_EXE_PREFIX','GTK_DATA_PREFIX','GIO_EXTRA_MODULES','GIO_MODULE_DIR','GDK_PIXBUF_MODULE_FILE','GDK_PIXBUF_MODULEDIR','QEMU_AUDIO_DRV','QEMU_MODULE_DIR','QEMU_BIOS_DIR','XDG_CONFIG_HOME','XDG_DATA_DIRS')) { + Remove-Item "Env:$name" -ErrorAction SilentlyContinue +} +$serial = "$dir\gtk-interactive-serial.log" +$arguments = @('-machine','pc','-accel','tcg','-smp','1','-m','128','-display','gtk,window-close=off,show-menubar=off','-monitor','none','-serial',"file:$serial",'-drive',"file=$dir\serial-boot.img,format=raw,if=floppy",'-boot','a') +$timer = [Diagnostics.Stopwatch]::StartNew() +$p = Start-Process $qemu -WorkingDirectory $dir -ArgumentList $arguments -RedirectStandardOutput "$dir\gtk-interactive-out.log" -RedirectStandardError "$dir\gtk-interactive-err.log" -PassThru +$ready = $false +try { + while (-not $p.HasExited -and $timer.Elapsed.TotalSeconds -lt 30) { + if ((Test-Path $serial) -and (Select-String -Path $serial -SimpleMatch WOOTC_WHPX_BOOTSECTOR_EXECUTED -Quiet)) { $ready = $true; break } + Start-Sleep -Milliseconds 100 + $p.Refresh() + } + Write-Output "BUNDLE_GTK_BOOT=$ready SECONDS=$($timer.Elapsed.TotalSeconds) SESSION=$($p.SessionId)" + if (-not $ready) { throw 'Bundled GTK runtime did not execute guest marker' } + foreach ($module in $p.Modules) { + $path = $module.FileName + if (-not $path.StartsWith("$dir\qemu\", [StringComparison]::OrdinalIgnoreCase) -and -not $path.StartsWith('C:\Windows\System32\', [StringComparison]::OrdinalIgnoreCase) -and -not $path.StartsWith('C:\Windows\WinSxS\', [StringComparison]::OrdinalIgnoreCase)) { throw "Module loaded outside runtime or Windows: $path" } + if ($path.StartsWith("$dir\qemu\", [StringComparison]::OrdinalIgnoreCase)) { Write-Output "BUNDLE_MODULE=$($module.ModuleName)" } + } +} finally { + if (-not $p.HasExited) { Stop-Process -Id $p.Id -Force } + Get-Content "$dir\gtk-interactive-err.log" -ErrorAction SilentlyContinue + Get-Content $serial -ErrorAction SilentlyContinue +} + +Stop-Transcript | Out-Null diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-session0-probe.ps1 b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-session0-probe.ps1 new file mode 100644 index 00000000..b9c379a9 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-session0-probe.ps1 @@ -0,0 +1,33 @@ +$ErrorActionPreference = 'Stop' +$dir = 'C:\Windows\Temp\wootc-runtime-bundle-probe' +$qemu = "$dir\qemu\qemu-system-x86_64.exe" +$env:PATH = "$dir\qemu;C:\Windows\System32;C:\Windows" +$env:TEMP = $dir +$env:TMP = $dir +$env:HOME = $dir +foreach ($name in @('GTK_PATH','GTK_EXE_PREFIX','GTK_DATA_PREFIX','GIO_EXTRA_MODULES','GIO_MODULE_DIR','GDK_PIXBUF_MODULE_FILE','GDK_PIXBUF_MODULEDIR','QEMU_AUDIO_DRV','QEMU_MODULE_DIR','QEMU_BIOS_DIR','XDG_CONFIG_HOME','XDG_DATA_DIRS')) { + Remove-Item "Env:$name" -ErrorAction SilentlyContinue +} +$serial = "$dir\gtk-serial.log" +$arguments = @('-machine','pc','-accel','tcg','-smp','1','-m','128','-display','gtk,window-close=off,show-menubar=off','-monitor','none','-serial',"file:$serial",'-drive',"file=$dir\serial-boot.img,format=raw,if=floppy",'-boot','a') +$timer = [Diagnostics.Stopwatch]::StartNew() +$p = Start-Process $qemu -WorkingDirectory $dir -ArgumentList $arguments -RedirectStandardOutput "$dir\gtk-out.log" -RedirectStandardError "$dir\gtk-err.log" -PassThru +$ready = $false +try { + while (-not $p.HasExited -and $timer.Elapsed.TotalSeconds -lt 30) { + if ((Test-Path $serial) -and (Select-String -Path $serial -SimpleMatch WOOTC_WHPX_BOOTSECTOR_EXECUTED -Quiet)) { $ready = $true; break } + Start-Sleep -Milliseconds 100 + $p.Refresh() + } + Write-Output "BUNDLE_GTK_BOOT=$ready SECONDS=$($timer.Elapsed.TotalSeconds) SESSION=$($p.SessionId)" + if (-not $ready) { throw 'Bundled GTK runtime did not execute guest marker' } + foreach ($module in $p.Modules) { + $path = $module.FileName + if (-not $path.StartsWith("$dir\qemu\", [StringComparison]::OrdinalIgnoreCase) -and -not $path.StartsWith('C:\Windows\System32\', [StringComparison]::OrdinalIgnoreCase) -and -not $path.StartsWith('C:\Windows\WinSxS\', [StringComparison]::OrdinalIgnoreCase)) { throw "Module loaded outside runtime or Windows: $path" } + if ($path.StartsWith("$dir\qemu\", [StringComparison]::OrdinalIgnoreCase)) { Write-Output "BUNDLE_MODULE=$($module.ModuleName)" } + } +} finally { + if (-not $p.HasExited) { Stop-Process -Id $p.Id -Force } + Get-Content "$dir\gtk-err.log" -ErrorAction SilentlyContinue + Get-Content $serial -ErrorAction SilentlyContinue +} diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-task.ps1 b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-task.ps1 new file mode 100644 index 00000000..93b4a639 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/gtk-task.ps1 @@ -0,0 +1,10 @@ +$ErrorActionPreference = 'Stop' +$user = (Get-CimInstance Win32_ComputerSystem).UserName +if (-not $user) { throw 'No interactive Windows user' } +$taskName = 'wootc-runtime-gtk-probe-20260926' +if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) { throw 'Existing task; preserve previous run' } +$action = New-ScheduledTaskAction -Execute 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -Argument '-NoLogo -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\wootc-runtime-bundle-probe\gtk-interactive.ps1' +$principal = New-ScheduledTaskPrincipal -UserId $user -LogonType Interactive -RunLevel Highest +Register-ScheduledTask -TaskName $taskName -Action $action -Principal $principal | Out-Null +Start-ScheduledTask -TaskName $taskName +Write-Output "STARTED_INTERACTIVE_USER=$user TASK=$taskName" diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/runtime-probe.ps1 b/docs/experiments/evidence/2026-09-26-vm-runtime/runtime-probe.ps1 new file mode 100644 index 00000000..f26dda53 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/runtime-probe.ps1 @@ -0,0 +1,41 @@ +$ErrorActionPreference = 'Stop' +$ProgressPreference = 'SilentlyContinue' +$dir = 'C:\Windows\Temp\wootc-runtime-bundle-probe' +if (Test-Path $dir) { throw 'Probe directory already exists; preserve previous evidence' } +New-Item -ItemType Directory -Path $dir | Out-Null +Invoke-WebRequest -UseBasicParsing 'http://10.104.210.10:8080/wootc-vm-runtime.zip' -OutFile "$dir\runtime.zip" +if ((Get-FileHash -Algorithm SHA256 "$dir\runtime.zip").Hash.ToLowerInvariant() -ne '7b40edf55a7686cd6e59088432717e3c5293b2378d115c671d922da7c97e869b') { throw 'Runtime ZIP hash mismatch' } +Invoke-WebRequest -UseBasicParsing 'http://10.104.210.10:8080/serial-boot.img' -OutFile "$dir\serial-boot.img" +if ((Get-FileHash -Algorithm SHA256 "$dir\serial-boot.img").Hash.ToLowerInvariant() -ne 'f591bb62b9fce510dc7a4a096940ffbfc596d925739416559017cfb2a92e7195') { throw 'Bootsector hash mismatch' } +Expand-Archive -Path "$dir\runtime.zip" -DestinationPath $dir +$qemu = "$dir\qemu\qemu-system-x86_64.exe" +$env:PATH = "$dir\qemu;C:\Windows\System32;C:\Windows" +$env:TEMP = $dir +$env:TMP = $dir +$env:HOME = $dir +foreach ($name in @('GTK_PATH','GTK_EXE_PREFIX','GTK_DATA_PREFIX','GIO_EXTRA_MODULES','GIO_MODULE_DIR','GDK_PIXBUF_MODULE_FILE','GDK_PIXBUF_MODULEDIR','QEMU_AUDIO_DRV','QEMU_MODULE_DIR','QEMU_BIOS_DIR','XDG_CONFIG_HOME','XDG_DATA_DIRS')) { + Remove-Item "Env:$name" -ErrorAction SilentlyContinue +} +Set-Location $dir +& $qemu '--version' +if ($LASTEXITCODE -ne 0) { throw 'Bundled QEMU cannot load' } +& $qemu '-display' 'help' +if ($LASTEXITCODE -ne 0) { throw 'Bundled QEMU display help failed' } +$serial = "$dir\serial.log" +$arguments = @('-machine','pc','-accel','tcg','-smp','1','-m','128','-display','none','-monitor','none','-serial',"file:$serial",'-drive',"file=$dir\serial-boot.img,format=raw,if=floppy",'-boot','a') +$timer = [Diagnostics.Stopwatch]::StartNew() +$p = Start-Process $qemu -WorkingDirectory $dir -ArgumentList $arguments -RedirectStandardOutput "$dir\out.log" -RedirectStandardError "$dir\err.log" -PassThru +$ready = $false +try { + while (-not $p.HasExited -and $timer.Elapsed.TotalSeconds -lt 30) { + if ((Test-Path $serial) -and (Select-String -Path $serial -SimpleMatch WOOTC_WHPX_BOOTSECTOR_EXECUTED -Quiet)) { $ready = $true; break } + Start-Sleep -Milliseconds 100 + $p.Refresh() + } + Write-Output "BUNDLE_TCG_BOOT=$ready SECONDS=$($timer.Elapsed.TotalSeconds)" + if (-not $ready) { throw 'Bundled runtime did not execute the guest marker' } +} finally { + if (-not $p.HasExited) { Stop-Process -Id $p.Id -Force } + Get-Content "$dir\err.log" -ErrorAction SilentlyContinue + Get-Content $serial -ErrorAction SilentlyContinue +} diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-interactive.log b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-interactive.log new file mode 100644 index 00000000..a8c02190 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-interactive.log @@ -0,0 +1,136 @@ + +TaskName State +-------- ----- +wootc-runtime-gtk-probe-20260926 Ready + +********************** +Windows PowerShell transcript start +Start time: 20260926183129 +Username: WOOTC-TEST\wootc +RunAs User: WOOTC-TEST\wootc +Configuration Name: +Machine: WOOTC-TEST (Microsoft Windows NT 10.0.26200.0) +Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\wootc-runtime-bundle-probe\gtk-interactive.ps1 +Process ID: 10092 +PSVersion: 5.1.26100.7920 +PSEdition: Desktop +PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.26100.7920 +BuildVersion: 10.0.26100.7920 +CLRVersion: 4.0.30319.42000 +WSManStackVersion: 3.0 +PSRemotingProtocolVersion: 2.3 +SerializationVersion: 1.1.0.1 +********************** +BUNDLE_GTK_BOOT=True SECONDS=2.5399571 SESSION=1 +BUNDLE_MODULE=qemu-system-x86_64.exe +BUNDLE_MODULE=SDL2.dll +BUNDLE_MODULE=libbz2-1.dll +BUNDLE_MODULE=brlapi-0.8.dll +BUNDLE_MODULE=SDL2_image.dll +BUNDLE_MODULE=libcacard-0.dll +BUNDLE_MODULE=libcapstone.dll +BUNDLE_MODULE=libcurl-4.dll +BUNDLE_MODULE=libepoxy-0.dll +BUNDLE_MODULE=libfdt-1.dll +BUNDLE_MODULE=libgdk-3-0.dll +BUNDLE_MODULE=libgio-2.0-0.dll +BUNDLE_MODULE=libglib-2.0-0.dll +BUNDLE_MODULE=libgmodule-2.0-0.dll +BUNDLE_MODULE=libgobject-2.0-0.dll +BUNDLE_MODULE=libgtk-3-0.dll +BUNDLE_MODULE=libgnutls-30.dll +BUNDLE_MODULE=libintl-8.dll +BUNDLE_MODULE=libjack64.dll +BUNDLE_MODULE=libjpeg-8.dll +BUNDLE_MODULE=libiconv-2.dll +BUNDLE_MODULE=liblzo2-2.dll +BUNDLE_MODULE=libncursesw6.dll +BUNDLE_MODULE=libnfs-16.dll +BUNDLE_MODULE=libpixman-1-0.dll +BUNDLE_MODULE=libsasl2-3.dll +BUNDLE_MODULE=libpng16-16.dll +BUNDLE_MODULE=libslirp-0.dll +BUNDLE_MODULE=libsnappy.dll +BUNDLE_MODULE=libssh.dll +BUNDLE_MODULE=libu2f-emu-0.dll +BUNDLE_MODULE=libusb-1.0.dll +BUNDLE_MODULE=libgdk_pixbuf-2.0-0.dll +BUNDLE_MODULE=libusbredirparser-1.dll +BUNDLE_MODULE=libcairo-2.dll +BUNDLE_MODULE=libspice-server-1.dll +BUNDLE_MODULE=libvirglrenderer-1.dll +BUNDLE_MODULE=zlib1.dll +BUNDLE_MODULE=libwinpthread-1.dll +BUNDLE_MODULE=libzstd.dll +BUNDLE_MODULE=libssp-0.dll +BUNDLE_MODULE=libjxl.dll +BUNDLE_MODULE=libtiff-6.dll +BUNDLE_MODULE=libwebp-7.dll +BUNDLE_MODULE=libwebpdemux-2.dll +BUNDLE_MODULE=nss3.dll +BUNDLE_MODULE=libnspr4.dll +BUNDLE_MODULE=libidn2-0.dll +BUNDLE_MODULE=libbrotlidec.dll +BUNDLE_MODULE=libssh2-1.dll +BUNDLE_MODULE=libpsl-5.dll +BUNDLE_MODULE=libavif-16.dll +BUNDLE_MODULE=libcairo-gobject-2.dll +BUNDLE_MODULE=libpango-1.0-0.dll +BUNDLE_MODULE=libfribidi-0.dll +BUNDLE_MODULE=libpangowin32-1.0-0.dll +BUNDLE_MODULE=libpcre2-8-0.dll +BUNDLE_MODULE=libpangocairo-1.0-0.dll +BUNDLE_MODULE=libbrotlienc.dll +BUNDLE_MODULE=libffi-8.dll +BUNDLE_MODULE=libgmp-10.dll +BUNDLE_MODULE=libhogweed-7.dll +BUNDLE_MODULE=libp11-kit-0.dll +BUNDLE_MODULE=libnettle-9.dll +BUNDLE_MODULE=libtasn1-6.dll +BUNDLE_MODULE=libunistring-5.dll +BUNDLE_MODULE=libatk-1.0-0.dll +BUNDLE_MODULE=libgcc_s_seh-1.dll +BUNDLE_MODULE=libdb-6.2.dll +BUNDLE_MODULE=libsystre-0.dll +BUNDLE_MODULE=libstdc++-6.dll +BUNDLE_MODULE=libharfbuzz-0.dll +BUNDLE_MODULE=libcrypto-3-x64.dll +BUNDLE_MODULE=libgstapp-1.0-0.dll +BUNDLE_MODULE=liblz4.dll +BUNDLE_MODULE=libopus-0.dll +BUNDLE_MODULE=liborc-0.4-0.dll +BUNDLE_MODULE=libgstreamer-1.0-0.dll +BUNDLE_MODULE=libssl-3-x64.dll +BUNDLE_MODULE=libfreetype-6.dll +BUNDLE_MODULE=libfontconfig-1.dll +BUNDLE_MODULE=libhwy.dll +BUNDLE_MODULE=libjxl_cms.dll +BUNDLE_MODULE=libdeflate.dll +BUNDLE_MODULE=libLerc.dll +BUNDLE_MODULE=libjbig-0.dll +BUNDLE_MODULE=liblzma-5.dll +BUNDLE_MODULE=nssutil3.dll +BUNDLE_MODULE=libsharpyuv-0.dll +BUNDLE_MODULE=libplds4.dll +BUNDLE_MODULE=libbrotlicommon.dll +BUNDLE_MODULE=libdav1d-7.dll +BUNDLE_MODULE=librav1e.dll +BUNDLE_MODULE=libaom.dll +BUNDLE_MODULE=libyuv.dll +BUNDLE_MODULE=libSvtAv1Enc-4.dll +BUNDLE_MODULE=libplc4.dll +BUNDLE_MODULE=libthai-0.dll +BUNDLE_MODULE=libpangoft2-1.0-0.dll +BUNDLE_MODULE=libtre-5.dll +BUNDLE_MODULE=libgraphite2.dll +BUNDLE_MODULE=libgstbase-1.0-0.dll +BUNDLE_MODULE=libexpat-1.dll +BUNDLE_MODULE=liblcms2-2.dll +BUNDLE_MODULE=libdatrie-1.dll +WOOTC_WHPX_BOOTSECTOR_EXECUTED +********************** +Windows PowerShell transcript end +End time: 20260926183133 +********************** + + diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-session0.log b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-session0.log new file mode 100644 index 00000000..e1a84031 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-gtk-session0.log @@ -0,0 +1,82 @@ +BUNDLE_GTK_BOOT=False SECONDS=30.0479868 SESSION=0 +C:\Windows\Temp\wootc-runtime-bundle-probe\qemu\qemu-system-x86_64.exe: Gdk: gdk_monitor_get_geometry: assertion 'GDK_IS_MONITOR (monitor)' failed +C:\Windows\Temp\wootc-runtime-bundle-probe\qemu\qemu-system-x86_64.exe: Gdk: _gdk_win32_monitor_get_pixel_structure: assertion 'monitor != NULL' failed + +(qemu:12928): Gdk-WARNING **: 18:29:42.895: ../gtk-3.24.52/gdk/win32/gdkwindow-win32.c:527: DwmEnableBlurBehindWindow (0000000000250074) failed: 80263001 +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gdk_monitor_get_refresh_rate: assertion 'GDK_IS_MONITOR (monitor)' failed +qemu: Gdk: gd +Bundled GTK runtime did not execute guest marker +At line:23 char:22 ++ ... t $ready) { throw 'Bundled GTK runtime did not execute guest marker' ... ++ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + CategoryInfo : OperationStopped: (Bundled GTK run...te guest marker:String) [], RuntimeException + + FullyQualifiedErrorId : Bundled GTK runtime did not execute guest marker + diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/windows-tcg.log b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-tcg.log new file mode 100644 index 00000000..332130c2 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-tcg.log @@ -0,0 +1,16 @@ +QEMU emulator version 11.1.0 (v11.1.0-12130-ge470268ff4) +Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers +Available display backend types: +none +gtk +sdl +egl-headless +curses +spice-app +dbus + +Some display backends support suboptions, which can be set with + -display backend,option=value,option=value... +For a short list of the suboptions for each display, see the top-level -help output; more detail is in the documentation. +BUNDLE_TCG_BOOT=True SECONDS=0.5450885 +WOOTC_WHPX_BOOTSECTOR_EXECUTED diff --git a/docs/experiments/windows-vm-runtime-2026-09-26.md b/docs/experiments/windows-vm-runtime-2026-09-26.md new file mode 100644 index 00000000..aa162689 --- /dev/null +++ b/docs/experiments/windows-vm-runtime-2026-09-26.md @@ -0,0 +1,78 @@ +# Windows VM runtime experiment, 2026-09-26 + +The VM-first path needs a runtime that the installer can verify and fetch. +A user should not need to find and install QEMU by hand. +This experiment tests a smaller x86 bundle. It does not enable a new release asset. + +## Build + +`packaging/build-vm-runtime.py` checks the pinned installer SHA-512 before extraction. +It does not run the upstream installer. It retains the x86 emulator, all root DLLs, +x86 firmware, display data, documentation and license files. +It adds the helper kernel, initramfs and protocol file from a local build. + +Each file enters `SHA256SUMS`. The build signs that manifest with the release seed. +The seed stays outside the bundle. The app must embed the matching public key. +The outer release manifest must also cover the ZIP before the app extracts it. +See [artifact authentication](../artifact-authentication.md) for the trust model. + +```bash +python3 packaging/build-vm-runtime.py \ + --helper-dir /path/to/helper-artifacts \ + --signing-seed /private/build/seed \ + --output /path/to/wootc-vm-runtime.zip +``` + +Go, Python 3.11 or later, and 7-Zip must be available. +Use `--installer` for a cached input. The same hash check still applies. +Use `--seven-zip` when the extraction tool is outside PATH. + +## Measured results + +| Artifact | Bytes | +|---|---:| +| Upstream installer | 206,615,928 | +| Full upstream installation, all architectures | 1,255,998,954 | +| Selected runtime, with helper, unpacked | 321,059,722 | +| Selected runtime ZIP, with helper | 183,295,958 | + +The signed manifest covers 3,282 files. The checks passed for the signature and each file hash +after ZIP creation. The [bundle record](evidence/2026-09-26-vm-runtime/bundle.json) +pins the ZIP and public key. The helper came from commit `4f9985d`. +It predates account setup; a release must use the final contract for the helper. + +The probe copied the ZIP to a temporary directory on the Corral Windows 11 fixture. +It checked SHA-256 before extraction. PATH excluded the installed QEMU copy. +The probe used private temporary and home directories and cleared display overrides. + +- Headless TCG executed the boot-sector marker in 0.545 seconds. +- GTK in Windows session 1 executed the same marker in 2.540 seconds. +- Loaded modules came from the bundle or Windows system directories. +- GTK accepted `window-close=off,show-menubar=off`. + +The [headless log](evidence/2026-09-26-vm-runtime/windows-tcg.log) and +[interactive log](evidence/2026-09-26-vm-runtime/windows-gtk-interactive.log) +record those checks. The scripts in the same directory show their scope. +These short TCG probes do not measure a Linux desktop or its performance. + +An earlier GTK test in session 0 failed to execute the marker in 30 seconds. +GDK reported that no monitor existed. Its +[failure log](evidence/2026-09-26-vm-runtime/windows-gtk-session0.log) remains in the record. +The repeat used a task with an interactive principal and no time trigger. +It did not change the runtime files or display flags. +Do not launch the desktop from a service session. + +## Remaining release gates + +Prove helper preparation and a usable Linux desktop with this exact bundle. +Test restart, persisted work, shutdown, keyboard input and missing dependencies. +The app must offer a clear shutdown control when the QEMU close button is disabled. + +Complete verified download, bounded extraction and atomic runtime publication in the app. +Do not expose a partial runtime or trust an unsigned local manifest. + +Record the exact corresponding source and build inputs for QEMU and its DLLs +before distribution. The upstream binary reports commit `e470268ff4`; +this experiment did not resolve the source commit or full dependency record. +The license files do not complete that provenance work. +No release workflow publishes this experimental ZIP. diff --git a/packaging/build-vm-runtime.py b/packaging/build-vm-runtime.py new file mode 100644 index 00000000..39dc6c43 --- /dev/null +++ b/packaging/build-vm-runtime.py @@ -0,0 +1,145 @@ +#!/usr/bin/env python3 +"""Package the pinned x86 Windows QEMU runtime without executing its installer. + +The private manifest seed stays outside the archive. Every selected file, +including DLLs and helper images, is covered by the inner signed manifest. +""" +import argparse +import hashlib +import json +from pathlib import Path +import shutil +import subprocess +import tempfile +import urllib.request +import zipfile + +ROOT = Path(__file__).resolve().parents[1] +SOURCE = ROOT / "packaging/qemu-windows-source.json" +REQUIRED = ("qemu-system-x86_64.exe", "COPYING", "COPYING.LIB", "README.rst", + "VERSION", "share/edk2-x86_64-code.fd", "share/edk2-i386-vars.fd", + "share/edk2-licenses.txt", "share/bios-256k.bin", "share/vgabios-stdvga.bin") +SHARE_DIRS = {"doc", "icons", "keymaps", "locale", "man"} +SHARE_FILES = {"edk2-x86_64-code.fd", "edk2-x86_64-secure-code.fd", "edk2-i386-vars.fd", + "edk2-licenses.txt", "bios.bin", "bios-256k.bin", "bios-microvm.bin", + "kvmvapic.bin", "linuxboot_dma.bin", "multiboot_dma.bin", "pvh.bin", + "qboot.rom", "trace-events-all"} + + +def digest(path, algorithm="sha256"): + with path.open("rb") as stream: + return hashlib.file_digest(stream, algorithm).hexdigest() + + +def selected_files(source): + """Keep x86 system emulator, all DLLs, display data, docs and x86 firmware. + + Keeping all DLLs also retains dependencies loaded dynamically by display + drivers. PE import-table traversal alone does not establish their absence. + """ + for name in REQUIRED: + if not (source / name).is_file(): + raise ValueError(f"QEMU runtime input missing: {name}") + files = [] + for path in sorted(source.rglob("*")): + if path.is_symlink(): + raise ValueError(f"runtime source contains a symlink: {path}") + if not path.is_file(): + continue + relative = path.relative_to(source) + name = relative.as_posix() + parts = relative.parts + keep = name in REQUIRED + if len(parts) == 1 and path.suffix.lower() == ".dll": + keep = True + if parts[0] == "share" and len(parts) > 1: + keep |= parts[1] in SHARE_DIRS + keep |= len(parts) == 2 and (parts[1] in SHARE_FILES or + parts[1].startswith(("vgabios", "efi-", "pxe-"))) + if len(parts) == 3 and parts[1] == "firmware": + keep |= "x86_64" in parts[2] or "i386" in parts[2] + if parts[0] == "lib": + keep = True + if keep: + if any(char.isspace() for char in name) or "\\" in name or ":" in name: + raise ValueError(f"unsupported manifest filename: {name}") + files.append(relative) + return files + + +def create_runtime(source, destination, helper, provenance): + destination.mkdir(parents=True, exist_ok=False) + for relative in selected_files(source): + output = destination / relative + output.parent.mkdir(parents=True, exist_ok=True) + shutil.copyfile(source / relative, output) + for name in ("builder-vmlinuz", "builder-initramfs.img", "builder-protocol.json"): + if not (helper / name).is_file() or (helper / name).stat().st_size == 0: + raise ValueError(f"missing helper artifact: {name}") + shutil.copyfile(helper / name, destination / name) + protocol = json.loads((destination / "builder-protocol.json").read_text()) + if protocol.get("protocol") != "wootc-helper" or protocol.get("protocolVersion") != 1: + raise ValueError("unsupported VM helper protocol") + (destination / "runtime-source.json").write_text(json.dumps(provenance, indent=2) + "\n") + lines = [f"{digest(path)} {path.relative_to(destination).as_posix()}\n" + for path in sorted(destination.rglob("*")) if path.is_file()] + (destination / "SHA256SUMS").write_text("".join(lines)) + + +def archive_runtime(source, output): + output.parent.mkdir(parents=True, exist_ok=True) + with zipfile.ZipFile(output, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive: + for path in sorted(source.rglob("*")): + if not path.is_file(): + continue + name = "qemu/" + path.relative_to(source).as_posix() + info = zipfile.ZipInfo(name, date_time=(2000, 1, 1, 0, 0, 0)) + info.compress_type = zipfile.ZIP_DEFLATED + info.external_attr = 0o100644 << 16 + with path.open("rb") as incoming, archive.open(info, "w", force_zip64=True) as outgoing: + shutil.copyfileobj(incoming, outgoing) + + +def build(installer, helper, seed, output, seven_zip): + provenance = json.loads(SOURCE.read_text()) + with tempfile.TemporaryDirectory(prefix="wootc-vm-runtime-") as temp: + work = Path(temp) + if installer is None: + installer = work / "qemu-setup.exe" + with urllib.request.urlopen(provenance["url"], timeout=120) as response, installer.open("wb") as target: + shutil.copyfileobj(response, target) + if digest(installer, "sha512") != provenance["sha512"]: + raise ValueError("QEMU installer does not match the pinned SHA-512") + extracted = work / "extracted" + subprocess.run([seven_zip, "x", "-y", f"-o{extracted}", str(installer)], check=True, + stdout=subprocess.DEVNULL) + runtime = work / "qemu" + create_runtime(extracted, runtime, helper, provenance) + subprocess.run(["go", "run", "./tools/signmanifest", "sign", str(seed), + str(runtime / "SHA256SUMS"), str(runtime / "SHA256SUMS.sig")], + cwd=ROOT / "app", check=True) + archive_runtime(runtime, output) + print(json.dumps({"archive": str(output), "bytes": output.stat().st_size, + "sha256": digest(output), "runtime_bytes": sum( + p.stat().st_size for p in runtime.rglob("*") if p.is_file())})) + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--installer", type=Path, help="reuse a cached installer; SHA-512 is still mandatory") + parser.add_argument("--helper-dir", required=True, type=Path) + parser.add_argument("--signing-seed", required=True, type=Path) + parser.add_argument("--output", required=True, type=Path) + parser.add_argument("--seven-zip", default=shutil.which("7zz") or shutil.which("7z")) + args = parser.parse_args() + if not args.seven_zip: + parser.error("7-Zip is required to extract the verified NSIS installer") + try: + build(args.installer.resolve() if args.installer else None, args.helper_dir.resolve(), + args.signing_seed.resolve(), args.output.resolve(), args.seven_zip) + except (OSError, ValueError, subprocess.CalledProcessError) as error: + parser.exit(1, f"VM runtime build failed: {error}\n") + + +if __name__ == "__main__": + main() diff --git a/packaging/qemu-windows-source.json b/packaging/qemu-windows-source.json new file mode 100644 index 00000000..de1d6f02 --- /dev/null +++ b/packaging/qemu-windows-source.json @@ -0,0 +1,7 @@ +{ + "version": "11.1.0", + "url": "https://qemu.weilnetz.de/w64/2026/qemu-w64-setup-20260811.exe", + "sha512": "5bcf9eed634e8575a37b74f445af41a2fe4106da512d0c30c368301d4c105037fdfab40a5287367a28a957624cddebbc8c07e16c88ab6634f554cdf3d16bf543", + "source": "https://qemu.weilnetz.de/w64/2026/", + "upstream_downloads": "https://www.qemu.org/download/" +} diff --git a/tests/unit/test_vm_runtime_bundle.py b/tests/unit/test_vm_runtime_bundle.py new file mode 100644 index 00000000..d3fc806e --- /dev/null +++ b/tests/unit/test_vm_runtime_bundle.py @@ -0,0 +1,81 @@ +#!/usr/bin/env python3 +"""Verify runtime package contents and that fixture private keys stay outside.""" +import importlib.util +import json +from pathlib import Path +import tempfile +import unittest +import zipfile + +ROOT = Path(__file__).resolve().parents[2] +spec = importlib.util.spec_from_file_location("runtime_builder", ROOT / "packaging/build-vm-runtime.py") +builder = importlib.util.module_from_spec(spec) +spec.loader.exec_module(builder) + + +class RuntimeBundle(unittest.TestCase): + def fixture(self, root): + source = root / "source" + for name in builder.REQUIRED: + file = source / name + file.parent.mkdir(parents=True, exist_ok=True) + file.write_bytes(b"fixture " + name.encode()) + for name in ("dependency.dll", "qemu-system-aarch64.exe", "share/edk2-aarch64-code.fd"): + (source / name).write_bytes(b"fixture") + helper = root / "helper" + helper.mkdir() + for name in ("builder-vmlinuz", "builder-initramfs.img"): + (helper / name).write_bytes(b"test helper") + (helper / "builder-protocol.json").write_text(json.dumps({"protocol": "wootc-helper", "protocolVersion": 1})) + return source, helper + + def test_archive_contains_only_selected_runtime_and_manifest(self): + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + source, helper = self.fixture(root) + private = root / "seed" + private.write_bytes(b"NEVER PUBLISH THIS PRIVATE SEED") + runtime = root / "qemu" + builder.create_runtime(source, runtime, helper, {"version": "fixture"}) + manifest = (runtime / "SHA256SUMS").read_text() + self.assertIn("dependency.dll", manifest) + self.assertIn("share/edk2-x86_64-code.fd", manifest) + self.assertIn("builder-initramfs.img", manifest) + self.assertNotIn("aarch64", manifest) + self.assertNotIn("seed", manifest) + (runtime / "SHA256SUMS.sig").write_bytes(b"fixture signature") + output = root / "runtime.zip" + builder.archive_runtime(runtime, output) + with zipfile.ZipFile(output) as archive: + self.assertIn("qemu/SHA256SUMS.sig", archive.namelist()) + self.assertIn("qemu/COPYING", archive.namelist()) + self.assertFalse(any(name.startswith("/") or ".." in Path(name).parts for name in archive.namelist())) + self.assertFalse(any(private.read_bytes() in archive.read(name) for name in archive.namelist())) + output2 = root / "runtime2.zip" + builder.archive_runtime(runtime, output2) + self.assertEqual(output.read_bytes(), output2.read_bytes()) + + def test_missing_firmware_and_symlinks_fail(self): + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + source, _ = self.fixture(root) + (source / "dependency.dll").unlink() + (source / "dependency.dll").symlink_to(root / "outside") + with self.assertRaises(ValueError): + builder.selected_files(source) + (source / "dependency.dll").unlink() + (source / "share/edk2-i386-vars.fd").unlink() + with self.assertRaises(ValueError): + builder.selected_files(source) + + def test_bad_installer_hash_rejected_before_extraction(self): + with tempfile.TemporaryDirectory() as tmp: + root = Path(tmp) + installer = root / "installer.exe" + installer.write_bytes(b"not the pinned QEMU installer") + with self.assertRaisesRegex(ValueError, "SHA-512"): + builder.build(installer, root, root / "seed", root / "out.zip", "must-not-execute") + + +if __name__ == "__main__": + unittest.main() From e613d01d63aae4cabe09118ff22b80567e8e7bc8 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:42:20 +0000 Subject: [PATCH 02/33] feat: verify and atomically install complete VM runtime bundles --- app/internal/runtimebundle/install.go | 257 ++++++++++++++++++ app/internal/runtimebundle/install_test.go | 206 ++++++++++++++ .../2026-09-26-vm-runtime/bundle.json | 3 +- .../2026-09-26-vm-runtime/windows-install.log | 48 ++++ .../2026-09-26-vm-runtime/windows-install.ps1 | 9 + .../windows-vm-runtime-2026-09-26.md | 24 +- 6 files changed, 544 insertions(+), 3 deletions(-) create mode 100644 app/internal/runtimebundle/install.go create mode 100644 app/internal/runtimebundle/install_test.go create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.log create mode 100644 docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.ps1 diff --git a/app/internal/runtimebundle/install.go b/app/internal/runtimebundle/install.go new file mode 100644 index 00000000..900e006f --- /dev/null +++ b/app/internal/runtimebundle/install.go @@ -0,0 +1,257 @@ +// Package runtimebundle installs a complete authenticated Windows VM runtime. +package runtimebundle + +import ( + "archive/zip" + "context" + "crypto/sha256" + "encoding/hex" + "fmt" + "io" + "os" + "path/filepath" + "strings" + "wootc/internal/artifactauth" +) + +const ( + MaxArchiveBytes = 256 << 20 + MaxExpandedBytes = 512 << 20 + MaxFileBytes = 128 << 20 + MaxFiles = 8192 +) + +// Install verifies the archive against a hash from an authenticated outer +// release manifest, then verifies the inner manifest and every file. The caller +// must hold the VM lease and supply an already protected, audited parent. +// Publication is one rename; an existing parent/qemu is never updated in place. +// A crash can leave a private .qemu-stage-* directory, never a partial qemu tree. +func Install(ctx context.Context, archivePath, parent, expectedHash, publicKey string) error { + want, err := hex.DecodeString(expectedHash) + if err != nil || len(want) != sha256.Size { + return fmt.Errorf("invalid runtime archive hash") + } + f, err := os.Open(archivePath) + if err != nil { + return err + } + defer f.Close() + st, err := f.Stat() + if err != nil { + return err + } + if !st.Mode().IsRegular() || st.Size() <= 0 || st.Size() > MaxArchiveBytes { + return fmt.Errorf("runtime archive exceeds bounds or is not a regular file") + } + hash := sha256.New() + n, err := io.Copy(hash, io.LimitReader(&contextReader{ctx, f}, MaxArchiveBytes+1)) + if err != nil { + return err + } + if n != st.Size() { + return fmt.Errorf("runtime archive size changed") + } + if !strings.EqualFold(hex.EncodeToString(hash.Sum(nil)), expectedHash) { + return fmt.Errorf("runtime archive checksum mismatch") + } + z, err := zip.NewReader(f, st.Size()) + if err != nil { + return err + } + files, err := inspect(z) + if err != nil { + return err + } + manifest, err := readFile(files["SHA256SUMS"], artifactauth.MaxManifestSize) + if err != nil { + return err + } + signature, err := readFile(files["SHA256SUMS.sig"], 64) + if err != nil { + return err + } + sums, err := artifactauth.Verify(publicKey, manifest, signature) + if err != nil { + return err + } + if len(sums)+2 != len(files) { + return fmt.Errorf("runtime manifest and archive differ") + } + for name := range sums { + if name == "SHA256SUMS" || name == "SHA256SUMS.sig" || files[name] == nil { + return fmt.Errorf("runtime manifest file missing or reserved: %s", name) + } + } + for _, name := range []string{"qemu-system-x86_64.exe", "share/edk2-x86_64-code.fd", "share/edk2-i386-vars.fd", "builder-vmlinuz", "builder-initramfs.img", "builder-protocol.json"} { + if files[name] == nil { + return fmt.Errorf("required runtime file missing: %s", name) + } + } + // Metadata was authenticated above. Re-reading it during extraction must + // produce those exact bytes too, even if the source archive changes. + for name, data := range map[string][]byte{"SHA256SUMS": manifest, "SHA256SUMS.sig": signature} { + sum := sha256.Sum256(data) + sums[name] = hex.EncodeToString(sum[:]) + } + if err = absent(filepath.Join(parent, "qemu")); err != nil { + return err + } + stage, err := os.MkdirTemp(parent, ".qemu-stage-") + if err != nil { + return err + } + defer os.RemoveAll(stage) + for name, file := range files { + if err = ctx.Err(); err != nil { + return err + } + target := filepath.Join(stage, filepath.FromSlash(name)) + if err = os.MkdirAll(filepath.Dir(target), 0700); err != nil { + return err + } + if err = extract(ctx, file, target, sums[name]); err != nil { + return err + } + } + if err = ctx.Err(); err != nil { + return err + } + if err = absent(filepath.Join(parent, "qemu")); err != nil { + return err + } + return os.Rename(stage, filepath.Join(parent, "qemu")) +} + +func absent(path string) error { + _, err := os.Lstat(path) + if os.IsNotExist(err) { + return nil + } + if err != nil { + return err + } + return fmt.Errorf("runtime already exists; preserve it until a stopped-VM update: %s", path) +} + +func inspect(z *zip.Reader) (map[string]*zip.File, error) { + if len(z.File) < 3 || len(z.File) > MaxFiles { + return nil, fmt.Errorf("runtime archive file count exceeds bounds") + } + files := map[string]*zip.File{} + spellings := map[string]string{} + var expanded uint64 + for _, file := range z.File { + if !strings.HasPrefix(file.Name, "qemu/") || !file.Mode().IsRegular() { + return nil, fmt.Errorf("runtime entry must be a regular file under qemu: %s", file.Name) + } + name := strings.TrimPrefix(file.Name, "qemu/") + parts := strings.Split(name, "/") + for i, part := range parts { + if !validComponent(part) { + return nil, fmt.Errorf("unsafe Windows runtime path: %s", name) + } + prefix := strings.Join(parts[:i+1], "/") + folded := strings.ToLower(prefix) + if prior, ok := spellings[folded]; ok && prior != prefix { + return nil, fmt.Errorf("runtime path has conflicting case: %s", name) + } + spellings[folded] = prefix + } + if files[name] != nil { + return nil, fmt.Errorf("duplicate runtime entry: %s", name) + } + if file.UncompressedSize64 > MaxFileBytes { + return nil, fmt.Errorf("runtime file exceeds bounds: %s", name) + } + expanded += file.UncompressedSize64 + if expanded > MaxExpandedBytes { + return nil, fmt.Errorf("expanded runtime exceeds bounds") + } + files[name] = file + } + for name := range files { + parts := strings.Split(name, "/") + for i := 1; i < len(parts); i++ { + if files[strings.Join(parts[:i], "/")] != nil { + return nil, fmt.Errorf("runtime file is also a directory: %s", name) + } + } + } + return files, nil +} + +func validComponent(part string) bool { + if part == "" || part == "." || part == ".." || strings.TrimRight(part, ". ") != part { + return false + } + for _, char := range part { + if char <= 32 || char > 126 || strings.ContainsRune(`\:<>"|?*`, char) { + return false + } + } + stem := strings.ToUpper(strings.SplitN(part, ".", 2)[0]) + switch stem { + case "CON", "PRN", "AUX", "NUL", "CLOCK$", "CONIN$", "CONOUT$": + return false + } + return !(len(stem) == 4 && (strings.HasPrefix(stem, "COM") || strings.HasPrefix(stem, "LPT")) && stem[3] >= '1' && stem[3] <= '9') +} + +func readFile(file *zip.File, limit int64) ([]byte, error) { + if file == nil || file.UncompressedSize64 > uint64(limit) { + return nil, fmt.Errorf("runtime metadata missing or exceeds bounds") + } + r, err := file.Open() + if err != nil { + return nil, err + } + defer r.Close() + data, err := io.ReadAll(io.LimitReader(r, limit+1)) + if err != nil { + return nil, err + } + if int64(len(data)) > limit { + return nil, fmt.Errorf("runtime metadata exceeds bounds") + } + return data, nil +} + +func extract(ctx context.Context, file *zip.File, target, checksum string) error { + r, err := file.Open() + if err != nil { + return err + } + defer r.Close() + w, err := os.OpenFile(target, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600) + if err != nil { + return err + } + defer w.Close() + hash := sha256.New() + n, err := io.Copy(io.MultiWriter(w, hash), io.LimitReader(&contextReader{ctx, r}, MaxFileBytes+1)) + if err != nil { + return err + } + if n > MaxFileBytes || uint64(n) != file.UncompressedSize64 { + return fmt.Errorf("runtime file size mismatch: %s", file.Name) + } + if checksum != "" && hex.EncodeToString(hash.Sum(nil)) != checksum { + return fmt.Errorf("runtime file checksum mismatch: %s", file.Name) + } + if err = w.Sync(); err != nil { + return err + } + return w.Close() +} + +type contextReader struct { + ctx context.Context + reader io.Reader +} + +func (r *contextReader) Read(p []byte) (int, error) { + if err := r.ctx.Err(); err != nil { + return 0, err + } + return r.reader.Read(p) +} diff --git a/app/internal/runtimebundle/install_test.go b/app/internal/runtimebundle/install_test.go new file mode 100644 index 00000000..bfbf8216 --- /dev/null +++ b/app/internal/runtimebundle/install_test.go @@ -0,0 +1,206 @@ +package runtimebundle + +import ( + "archive/zip" + "context" + "crypto/ed25519" + "crypto/rand" + "crypto/sha256" + "encoding/hex" + "fmt" + "os" + "path/filepath" + "sort" + "strings" + "testing" + "wootc/internal/artifactauth" +) + +type entry struct { + name string + data []byte + mode os.FileMode +} + +func fixture(t *testing.T, mutate func(*[]entry, *string)) (string, string, string) { + t.Helper() + public, private, err := ed25519.GenerateKey(rand.Reader) + if err != nil { + t.Fatal(err) + } + var entries []entry + var manifest strings.Builder + for _, name := range []string{"qemu-system-x86_64.exe", "share/edk2-x86_64-code.fd", "share/edk2-i386-vars.fd", "builder-vmlinuz", "builder-initramfs.img", "builder-protocol.json", "dependency.dll"} { + data := []byte("test runtime " + name) + fmt.Fprintf(&manifest, "%x %s\n", sha256.Sum256(data), name) + entries = append(entries, entry{"qemu/" + name, data, 0600}) + } + text := manifest.String() + if mutate != nil { + mutate(&entries, &text) + } + entries = append(entries, entry{"qemu/SHA256SUMS", []byte(text), 0600}, entry{"qemu/SHA256SUMS.sig", artifactauth.Sign(private, []byte(text)), 0600}) + return makeZip(t, entries), hex.EncodeToString(public), text +} + +func makeZip(t *testing.T, entries []entry) string { + t.Helper() + path := filepath.Join(t.TempDir(), "runtime.zip") + f, err := os.Create(path) + if err != nil { + t.Fatal(err) + } + z := zip.NewWriter(f) + for _, e := range entries { + h := &zip.FileHeader{Name: e.name, Method: zip.Deflate} + h.SetMode(e.mode) + w, err := z.CreateHeader(h) + if err != nil { + t.Fatal(err) + } + if _, err = w.Write(e.data); err != nil { + t.Fatal(err) + } + } + if err = z.Close(); err != nil { + t.Fatal(err) + } + if err = f.Close(); err != nil { + t.Fatal(err) + } + return path +} + +func archiveHash(t *testing.T, path string) string { + t.Helper() + data, err := os.ReadFile(path) + if err != nil { + t.Fatal(err) + } + return fmt.Sprintf("%x", sha256.Sum256(data)) +} + +func TestInstallAndPreserveExisting(t *testing.T) { + archive, key, _ := fixture(t, nil) + parent := t.TempDir() + if err := Install(context.Background(), archive, parent, archiveHash(t, archive), key); err != nil { + t.Fatal(err) + } + got, err := os.ReadFile(filepath.Join(parent, "qemu", "dependency.dll")) + if err != nil || string(got) != "test runtime dependency.dll" { + t.Fatalf("wrong installed file: %q %v", got, err) + } + if err = Install(context.Background(), archive, parent, archiveHash(t, archive), key); err == nil { + t.Fatal("overwrote existing runtime") + } + entries, err := os.ReadDir(parent) + if err != nil || len(entries) != 1 || entries[0].Name() != "qemu" { + t.Fatalf("left staging files: %v %v", entries, err) + } +} + +func TestRejectArchiveAndPreserveParent(t *testing.T) { + cases := map[string]func(*[]entry, *string){ + "extra DLL": func(e *[]entry, _ *string) { *e = append(*e, entry{"qemu/unsigned.dll", []byte("extra"), 0600}) }, + "missing DLL": func(e *[]entry, _ *string) { *e = (*e)[:len(*e)-1] }, + "edited payload": func(e *[]entry, _ *string) { (*e)[0].data = []byte("changed") }, + "duplicate": func(e *[]entry, _ *string) { *e = append(*e, (*e)[0]) }, + "directory case": func(e *[]entry, _ *string) { (*e)[2].name = "qemu/Share/edk2-i386-vars.fd" }, + "file case": func(e *[]entry, _ *string) { *e = append(*e, entry{"qemu/DEPENDENCY.dll", []byte("extra"), 0600}) }, + "traversal": func(e *[]entry, _ *string) { (*e)[0].name = "qemu/../escape" }, + "drive": func(e *[]entry, _ *string) { (*e)[0].name = "qemu/C:/escape" }, + "backslash": func(e *[]entry, _ *string) { (*e)[0].name = `qemu/share\escape` }, + "alternate stream": func(e *[]entry, _ *string) { (*e)[0].name = "qemu/file:stream" }, + "device": func(e *[]entry, _ *string) { (*e)[0].name = "qemu/NUL.dll" }, + "trailing dot": func(e *[]entry, _ *string) { (*e)[0].name = "qemu/dependency.dll." }, + "absolute": func(e *[]entry, _ *string) { (*e)[0].name = "/qemu/escape" }, + "symlink": func(e *[]entry, _ *string) { (*e)[0].mode = os.ModeSymlink | 0777 }, + "unmanifested required": func(e *[]entry, s *string) { *e = (*e)[1:]; *s = strings.Join(strings.Split(*s, "\n")[1:], "\n") }, + } + names := make([]string, 0, len(cases)) + for name := range cases { + names = append(names, name) + } + sort.Strings(names) + for _, name := range names { + t.Run(name, func(t *testing.T) { + archive, key, _ := fixture(t, cases[name]) + parent := t.TempDir() + if err := Install(context.Background(), archive, parent, archiveHash(t, archive), key); err == nil { + t.Fatal("accepted invalid bundle") + } + entries, err := os.ReadDir(parent) + if err != nil || len(entries) != 0 { + t.Fatalf("published invalid or partial runtime: %v %v", entries, err) + } + }) + } +} + +func TestOuterHashSignatureAndCancellation(t *testing.T) { + archive, key, _ := fixture(t, nil) + for _, kind := range []string{"outer hash", "signature", "cancel"} { + t.Run(kind, func(t *testing.T) { + parent := t.TempDir() + hash := archiveHash(t, archive) + useKey := key + ctx := context.Background() + switch kind { + case "outer hash": + hash = strings.Repeat("0", 64) + case "signature": + useKey = strings.Repeat("0", 64) + case "cancel": + var cancel context.CancelFunc + ctx, cancel = context.WithCancel(ctx) + cancel() + } + if err := Install(ctx, archive, parent, hash, useKey); err == nil { + t.Fatal("accepted untrusted or canceled installation") + } + entries, _ := os.ReadDir(parent) + if len(entries) != 0 { + t.Fatal("left partial runtime") + } + }) + } +} + +func TestRejectExpansionBounds(t *testing.T) { + for _, files := range [][]*zip.File{ + make([]*zip.File, MaxFiles+1), + {{FileHeader: zip.FileHeader{Name: "qemu/large", UncompressedSize64: MaxFileBytes + 1}}, {FileHeader: zip.FileHeader{Name: "qemu/a"}}, {FileHeader: zip.FileHeader{Name: "qemu/b"}}}, + {{FileHeader: zip.FileHeader{Name: "qemu/a", UncompressedSize64: MaxFileBytes}}, {FileHeader: zip.FileHeader{Name: "qemu/b", UncompressedSize64: MaxFileBytes}}, {FileHeader: zip.FileHeader{Name: "qemu/c", UncompressedSize64: MaxFileBytes}}, {FileHeader: zip.FileHeader{Name: "qemu/d", UncompressedSize64: MaxFileBytes}}, {FileHeader: zip.FileHeader{Name: "qemu/e", UncompressedSize64: 1}}}, + } { + if _, err := inspect(&zip.Reader{File: files}); err == nil { + t.Fatal("accepted oversized ZIP metadata") + } + } +} + +// An opt-in fixture test exercises the same installer on the actual signed +// runtime archive, on Linux or native Windows. No production path reads these. +func TestRealArchive(t *testing.T) { + archive := os.Getenv("WOOTC_TEST_RUNTIME_ARCHIVE") + if archive == "" { + t.Skip("no real runtime fixture supplied") + } + key := os.Getenv("WOOTC_TEST_RUNTIME_PUBLIC_KEY") + parent := t.TempDir() + if err := Install(context.Background(), archive, parent, archiveHash(t, archive), key); err != nil { + t.Fatal(err) + } + count := 0 + if err := filepath.WalkDir(filepath.Join(parent, "qemu"), func(_ string, entry os.DirEntry, err error) error { + if err != nil { + return err + } + if !entry.IsDir() { + count++ + } + return nil + }); err != nil { + t.Fatal(err) + } + t.Logf("authenticated and installed %d runtime files", count) +} diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json b/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json index ad42cdb8..a85c3e49 100644 --- a/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/bundle.json @@ -7,5 +7,6 @@ "helper_commit": "4f9985d", "helper_account_outcome": "image-default", "public_key": "def3840b56c1553b4a4de45f995fa007e30f9ff5763007e142ab924fbaefe661", - "scope": "Experimental local packaging. No runtime release or full Linux desktop verdict." + "scope": "Experimental local packaging. No runtime release or full Linux desktop verdict.", + "installer_test_exe_sha256": "2e17329d4c61503268a555deba69b131ccc83e9965ddb639af9aa36490c6b2fc" } diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.log b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.log new file mode 100644 index 00000000..c6716b21 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.log @@ -0,0 +1,48 @@ +=== RUN TestInstallAndPreserveExisting +--- PASS: TestInstallAndPreserveExisting (0.13s) +=== RUN TestRejectArchiveAndPreserveParent +=== RUN TestRejectArchiveAndPreserveParent/absolute +=== RUN TestRejectArchiveAndPreserveParent/alternate_stream +=== RUN TestRejectArchiveAndPreserveParent/backslash +=== RUN TestRejectArchiveAndPreserveParent/device +=== RUN TestRejectArchiveAndPreserveParent/directory_case +=== RUN TestRejectArchiveAndPreserveParent/drive +=== RUN TestRejectArchiveAndPreserveParent/duplicate +=== RUN TestRejectArchiveAndPreserveParent/edited_payload +=== RUN TestRejectArchiveAndPreserveParent/extra_DLL +=== RUN TestRejectArchiveAndPreserveParent/file_case +=== RUN TestRejectArchiveAndPreserveParent/missing_DLL +=== RUN TestRejectArchiveAndPreserveParent/symlink +=== RUN TestRejectArchiveAndPreserveParent/trailing_dot +=== RUN TestRejectArchiveAndPreserveParent/traversal +=== RUN TestRejectArchiveAndPreserveParent/unmanifested_required +--- PASS: TestRejectArchiveAndPreserveParent (0.36s) + --- PASS: TestRejectArchiveAndPreserveParent/absolute (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/alternate_stream (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/backslash (0.03s) + --- PASS: TestRejectArchiveAndPreserveParent/device (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/directory_case (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/drive (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/duplicate (0.03s) + --- PASS: TestRejectArchiveAndPreserveParent/edited_payload (0.03s) + --- PASS: TestRejectArchiveAndPreserveParent/extra_DLL (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/file_case (0.05s) + --- PASS: TestRejectArchiveAndPreserveParent/missing_DLL (0.03s) + --- PASS: TestRejectArchiveAndPreserveParent/symlink (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/trailing_dot (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/traversal (0.02s) + --- PASS: TestRejectArchiveAndPreserveParent/unmanifested_required (0.02s) +=== RUN TestOuterHashSignatureAndCancellation +=== RUN TestOuterHashSignatureAndCancellation/outer_hash +=== RUN TestOuterHashSignatureAndCancellation/signature +=== RUN TestOuterHashSignatureAndCancellation/cancel +--- PASS: TestOuterHashSignatureAndCancellation (0.03s) + --- PASS: TestOuterHashSignatureAndCancellation/outer_hash (0.02s) + --- PASS: TestOuterHashSignatureAndCancellation/signature (0.00s) + --- PASS: TestOuterHashSignatureAndCancellation/cancel (0.00s) +=== RUN TestRejectExpansionBounds +--- PASS: TestRejectExpansionBounds (0.00s) +=== RUN TestRealArchive + install_test.go:205: authenticated and installed 3284 runtime files +--- PASS: TestRealArchive (37.84s) +PASS diff --git a/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.ps1 b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.ps1 new file mode 100644 index 00000000..e2eddae0 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.ps1 @@ -0,0 +1,9 @@ +$ErrorActionPreference = 'Stop' +$ProgressPreference = 'SilentlyContinue' +$test = 'C:\Windows\Temp\wootc-runtime-install.test.exe' +Invoke-WebRequest -UseBasicParsing 'http://10.104.210.10:8080/wootc-runtime-install.test.exe' -OutFile $test +if ((Get-FileHash -Algorithm SHA256 $test).Hash.ToLowerInvariant() -ne '2e17329d4c61503268a555deba69b131ccc83e9965ddb639af9aa36490c6b2fc') { throw 'Native test binary hash mismatch' } +$env:WOOTC_TEST_RUNTIME_ARCHIVE = 'C:\Windows\Temp\wootc-runtime-bundle-probe\runtime.zip' +$env:WOOTC_TEST_RUNTIME_PUBLIC_KEY = 'def3840b56c1553b4a4de45f995fa007e30f9ff5763007e142ab924fbaefe661' +& $test '-test.v' +exit $LASTEXITCODE diff --git a/docs/experiments/windows-vm-runtime-2026-09-26.md b/docs/experiments/windows-vm-runtime-2026-09-26.md index aa162689..784a59e5 100644 --- a/docs/experiments/windows-vm-runtime-2026-09-26.md +++ b/docs/experiments/windows-vm-runtime-2026-09-26.md @@ -62,14 +62,34 @@ The repeat used a task with an interactive principal and no time trigger. It did not change the runtime files or display flags. Do not launch the desktop from a service session. +## Verified extraction + +`app/internal/runtimebundle.Install` checks the ZIP hash against the outer manifest, +then verifies the signature and all files in the inner manifest. +The caller must hold the VM lease and supply a protected parent directory. +The limits are 256 MiB for the ZIP, 512 MiB after extraction, 128 MiB per file, +and 8,192 entries. These limits fit the measured bundle, including its helper. + +The extractor rejects links, extra or missing files, duplicate paths, differences +in path case, Windows device names, alternate streams and paths outside the bundle. +It writes to a private temporary directory and publishes through one rename. +It refuses to change an existing runtime. Cancellation or a failed check removes temporary files. +A process crash can leave private temporary files; it cannot publish a partial runtime. + +The real archive passed this installer on Linux and native Windows. +Each run authenticated and installed 3,284 files, including the two manifest files. +The [native test log](evidence/2026-09-26-vm-runtime/windows-install.log) also records +the negative tests for corrupt payloads, unsafe paths, missing files and cancellation. +The edited-payload test failed when we removed the hash comparison. + ## Remaining release gates Prove helper preparation and a usable Linux desktop with this exact bundle. Test restart, persisted work, shutdown, keyboard input and missing dependencies. The app must offer a clear shutdown control when the QEMU close button is disabled. -Complete verified download, bounded extraction and atomic runtime publication in the app. -Do not expose a partial runtime or trust an unsigned local manifest. +Connect the extractor to verified download and the setup controls in the app. +Do not trust an unsigned local manifest. Record the exact corresponding source and build inputs for QEMU and its DLLs before distribution. The upstream binary reports commit `e470268ff4`; From cfd4a12b0957ff4ca176722d0981c633a13034df Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:16:43 +0000 Subject: [PATCH 03/33] Manage the persistent Windows VM disk and verified shutdown lifecycle --- app/app.go | 25 +- app/frontend/src/main.js | 14 +- app/frontend/src/screens/control.js | 13 +- app/frontend/src/screens/vmpreview.js | 26 +- app/frontend/wailsjs/go/main/App.js | 3 + app/installer_windows.go | 20 +- app/serve.go | 38 ++ app/tools/gendto/main.go | 1 + app/vm_builder_result.go | 80 ++++ app/vm_environment_windows.go | 20 + app/vm_guard.go | 30 ++ app/vm_image_windows.go | 46 +++ app/vm_job_windows.go | 37 ++ app/vm_job_windows_test.go | 65 ++++ app/vm_lifecycle.go | 126 ++++++ app/vm_lifecycle_test.go | 94 +++++ app/vm_lock_other.go | 31 ++ app/vm_lock_windows.go | 83 ++++ app/vm_managed_windows.go | 182 +++++++++ app/vm_other.go | 7 + app/vm_process.go | 172 +++++++++ app/vm_process_test.go | 134 +++++++ app/vm_qmp.go | 146 +++++++ app/vm_qmp_test.go | 21 + app/vm_resources.go | 28 ++ app/vm_runtime.go | 75 ++++ app/vm_runtime_test.go | 49 +++ app/vm_windows.go | 361 ++++++++++-------- .../2026-09-26-managed-vm/native-tests.log | 40 ++ docs/managed-vm.md | 90 +++++ docs/winui-shell.md | 7 + shell/Wootc.Shell/Engine/Dto.cs | 40 ++ 32 files changed, 1926 insertions(+), 178 deletions(-) create mode 100644 app/vm_builder_result.go create mode 100644 app/vm_environment_windows.go create mode 100644 app/vm_guard.go create mode 100644 app/vm_image_windows.go create mode 100644 app/vm_job_windows.go create mode 100644 app/vm_job_windows_test.go create mode 100644 app/vm_lifecycle.go create mode 100644 app/vm_lifecycle_test.go create mode 100644 app/vm_lock_other.go create mode 100644 app/vm_lock_windows.go create mode 100644 app/vm_managed_windows.go create mode 100644 app/vm_process.go create mode 100644 app/vm_process_test.go create mode 100644 app/vm_qmp.go create mode 100644 app/vm_qmp_test.go create mode 100644 app/vm_resources.go create mode 100644 app/vm_runtime.go create mode 100644 app/vm_runtime_test.go create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/native-tests.log create mode 100644 docs/managed-vm.md diff --git a/app/app.go b/app/app.go index 126a470d..794df553 100644 --- a/app/app.go +++ b/app/app.go @@ -220,11 +220,15 @@ type App struct { // mu guards status, cancellation, completion, and shutdown. GetStatus() is polled from the frontend // on a timer while the install goroutine mutates status concurrently — // without the lock that is a data race the Go race detector flags. - mu sync.Mutex - status InstallStatus - cancel context.CancelFunc - installDone chan struct{} - stopping bool + mu sync.Mutex + status InstallStatus + cancel context.CancelFunc + installDone chan struct{} + stopping bool + vmMu sync.Mutex + vmSession *vmSession + vmCancel context.CancelFunc + vmPrepareDone chan struct{} } func NewApp() *App { @@ -271,6 +275,7 @@ func (a *App) startup(ctx context.Context) { func previewMode() bool { return os.Getenv("WOOTC_UI_PREVIEW") == "1" } func (a *App) shutdown(ctx context.Context) { + a.shutdownVM() a.mu.Lock() cancel := a.cancel a.mu.Unlock() @@ -706,6 +711,11 @@ type UninstallInfo struct { // post-deploy loop (North Star audit): even when the deployer could not // re-arm itself, the user has a button that actually starts their Linux. func (a *App) BootIntoLinux() error { + release, err := acquireNativeInstallLease(wootcDir()) + if err != nil { + return err + } + defer release() if err := armOneShotFromPersistedGUID(); err != nil { return err } @@ -904,6 +914,11 @@ func runPipeline(ctx context.Context, cfg InstallConfig, emit func(ProgressEvent if err := prepareInstallState(cfg.StorageDrive); err != nil { return err } + release, err := acquireNativeInstallLease(wootcDir()) + if err != nil { + return err + } + defer release() // GUI routing is advisory. Enforce data preservation for every backend // caller before changing power settings, files, or firmware boot entries. if err := requireNewInstallRootDisk(); err != nil { diff --git a/app/frontend/src/main.js b/app/frontend/src/main.js index 923f000a..0a512f92 100644 --- a/app/frontend/src/main.js +++ b/app/frontend/src/main.js @@ -1,5 +1,5 @@ import '../src/style.css'; -import { GetInstallSteps, GetImages, GetSystemInfo, ExistingInstallFound, GetMode, GetSessionCandidates, GetBranding, GetReleaseNotice, GetUninstallInfo, GetVMCapability, GetFreshVMCapability, GetSupportPolicy, GetLastRun, GetRecoveryVerdict } from '../wailsjs/go/main/App'; +import { GetInstallSteps, GetImages, GetSystemInfo, ExistingInstallFound, GetMode, GetSessionCandidates, GetBranding, GetReleaseNotice, GetUninstallInfo, GetVMCapability, GetVMState, GetFreshVMCapability, GetSupportPolicy, GetLastRun, GetRecoveryVerdict } from '../wailsjs/go/main/App'; import { EventsOn } from '../wailsjs/runtime/runtime'; import { startE2EDrive } from './lib/e2e.js'; import { state } from './lib/state.js'; @@ -42,11 +42,16 @@ async function init() { // Try-in-VM builder progress (§6.1). Drives the preview screen while the // headless builder pulls the image and installs it onto preview.raw. - EventsOn('vm:progress', (e) => { + EventsOn('vm:progress', async (e) => { state.vmProgress = { stage: e.stage, percent: e.percent || 0, message: e.message || '' }; - if (e.stage === 'started' || e.stage === 'ready') state.vmReady = true; + state.vmReady = e.stage === 'started'; + if (['stopped', 'needs_recovery'].includes(e.stage)) state.vmState = { phase: e.stage, error: e.message }; + if (e.stage === 'needs_recovery') state.vmError = e.message; if (e.stage === 'error') state.vmError = e.message; - if (state.screen === 'vmpreview') render(); + if (['stopped', 'needs_recovery', 'started'].includes(e.stage)) { + try { state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); } catch {} + } + if (state.screen === 'vmpreview' || state.screen === 'control') render(); }); // Conversion progress events from the migration dashboard backend. @@ -124,6 +129,7 @@ async function init() { state.config.diskSizeGB = Math.min(200, Math.max(40, half)); } + try { state.vmState = await GetVMState(); } catch { state.vmState = null; } if (existing) { try { state.uninstallInfo = await GetUninstallInfo(); } catch { state.uninstallInfo = {}; } try { state.vmCapability = await GetVMCapability(); } catch { state.vmCapability = null; } diff --git a/app/frontend/src/screens/control.js b/app/frontend/src/screens/control.js index 6a09bd4f..5bb6a39c 100644 --- a/app/frontend/src/screens/control.js +++ b/app/frontend/src/screens/control.js @@ -1,5 +1,5 @@ import { installStepLabel } from './progress.js'; -import { BootInVM, UninstallWith, BootIntoLinux } from '../../wailsjs/go/main/App'; +import { BootInVM, StopVM, ForceStopVM, GetVMState, GetVMCapability, UninstallWith, BootIntoLinux } from '../../wailsjs/go/main/App'; import { Quit } from '../../wailsjs/runtime/runtime'; import { state } from '../lib/state.js'; import { render } from '../lib/render.js'; @@ -102,6 +102,15 @@ export function renderControlPanel() { // Boot-in-VM (§6.2): view Linux without rebooting, when the VM viewer is // present and WHPX is on. + if (['running', 'stopping'].includes(state.vmState?.phase)) { + screen.appendChild(btn('Shut down Linux', 'btn btn-primary', async () => { + try { await StopVM(); state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); render(); } catch (e) { alert(String(e)); } + })); + screen.appendChild(btn('Force stop…', 'btn btn-danger', async () => { + if (!confirm('Force stop Linux? Unsaved work may be lost and recovery will be required.')) return; + try { await ForceStopVM(); state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); render(); } catch (e) { alert(String(e)); } + })); + } const vm = state.vmCapability; if (vm) { const vmCard = el('div'); @@ -114,7 +123,7 @@ export function renderControlPanel() { : vm.reason} `; const vmBtn = btn('Boot in VM', 'btn btn-ghost', async () => { - try { await BootInVM(); } catch (e) { alert('Could not start the VM: ' + e); } + try { await BootInVM(); state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); render(); } catch (e) { alert('Could not start the VM: ' + e); } }); vmBtn.style.flexShrink = '0'; vmBtn.disabled = !vm.available; diff --git a/app/frontend/src/screens/vmpreview.js b/app/frontend/src/screens/vmpreview.js index 5a4340f8..10a62217 100644 --- a/app/frontend/src/screens/vmpreview.js +++ b/app/frontend/src/screens/vmpreview.js @@ -1,4 +1,4 @@ -import { TryInVMFresh } from '../../wailsjs/go/main/App'; +import { TryInVMFresh, StopVM, ForceStopVM, BootInVM, GetUninstallInfo, GetVMState, GetVMCapability } from '../../wailsjs/go/main/App'; import { state } from '../lib/state.js'; import { render } from '../lib/render.js'; import { distroName } from '../lib/branding.js'; @@ -39,17 +39,33 @@ export function renderVMPreviewScreen() {

Your VM window has opened

${state.selected?.name || distroName()} has started in its own window. Check that Linux reaches its desktop. Native boot is not available from this preview yet; keep the disk to preserve your work.
`; const row = el('div'); row.style.cssText = 'display:flex;gap:10px;margin-top:8px'; - row.appendChild(btn('Not now', 'btn btn-ghost', () => { state.screen = 'launchpad'; render(); })); + row.appendChild(btn('Shut down Linux', 'btn btn-primary', async () => { + try { await StopVM(); state.vmState = { phase: 'stopped' }; state.vmReady = false; render(); } + catch (e) { alert(String(e)); } + })); + row.appendChild(btn('Force stop…', 'btn btn-danger', async () => { + if (!confirm('Force stop Linux? Unsaved work may be lost. The disk will require recovery before restarting.')) return; + try { await ForceStopVM(); } catch (e) { alert(String(e)); } + })); + row.appendChild(btn('Manage Linux', 'btn btn-ghost', async () => { + state.uninstallInfo = await GetUninstallInfo(); state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); + state.screen = 'control'; render(); + })); screen.appendChild(row); + } else if (state.vmState?.phase === 'stopped') { + const title = el('h2'); title.textContent = 'Linux is shut down. Your work is saved on the same disk.'; screen.appendChild(title); + screen.appendChild(btn('Start Linux again', 'btn btn-primary', async () => { + try { await BootInVM(); state.vmReady = true; render(); } catch (e) { alert(String(e)); } + })); } else { const pct = Math.round(p.percent || 0); screen.innerHTML = `
🔨
-

Building your preview…

+

Preparing your Linux system…

${p.message || 'Working…'}
-
+
-
${pct}%
`; +
Preparation is in progress.
`; } wrap.appendChild(screen); return wrap; diff --git a/app/frontend/wailsjs/go/main/App.js b/app/frontend/wailsjs/go/main/App.js index 178db9ef..b049b618 100644 --- a/app/frontend/wailsjs/go/main/App.js +++ b/app/frontend/wailsjs/go/main/App.js @@ -162,3 +162,6 @@ export function GetReleaseNotice() { export function GetInstallSteps() { return window['go']['main']['App']['GetInstallSteps'](); } +export function GetVMState() { return window['go']['main']['App']['GetVMState'](); } +export function StopVM() { return window['go']['main']['App']['StopVM'](); } +export function ForceStopVM() { return window['go']['main']['App']['ForceStopVM'](); } diff --git a/app/installer_windows.go b/app/installer_windows.go index e5e0fce2..d322f1c9 100644 --- a/app/installer_windows.go +++ b/app/installer_windows.go @@ -385,6 +385,22 @@ func uninstallWith(ctx context.Context, opts UninstallOptions) error { } setStorageDrive(drive) + targetDrives := []string{drive} + if drive != "C" { + targetDrives = append(targetDrives, "C") + } + for _, d := range targetDrives { + disk := filepath.Join(d+`:\wootc`, "disks", "root.disk") + release, err := acquireVMLock(disk) + if err != nil { + return err + } + defer release() + if err := verifyVMDiskReleased(disk); err != nil { + return err + } + } + var errs []string // 0. Put back what install changed outside its folder: hibernation / @@ -405,10 +421,6 @@ func uninstallWith(ctx context.Context, opts UninstallOptions) error { // 3. Remove the install dir, staged files, cache, and logs. // Clean both the active storage drive and C: if distinct. - targetDrives := []string{drive} - if drive != "C" { - targetDrives = append(targetDrives, "C") - } for _, d := range targetDrives { if opts.RemovePartition { // Target files stay intact until the partition's final contents audit. diff --git a/app/serve.go b/app/serve.go index 303dd39e..b0f37a4b 100644 --- a/app/serve.go +++ b/app/serve.go @@ -49,6 +49,13 @@ var ProtocolMethods = []string{ "GetLastRun", "E2EDriveDirective", "E2EDriveReport", + "GetVMCapability", + "GetFreshVMCapability", + "GetVMState", + "TryInVMFresh", + "BootInVM", + "StopVM", + "ForceStopVM", "Shutdown", } @@ -294,6 +301,36 @@ func (s *Server) dispatch(ctx context.Context, req jsonrpcRequest) (any, *jsonrp s.app.E2EDriveReport(state) return nil, nil + case "GetVMCapability": + return s.app.GetVMCapability(), nil + case "GetFreshVMCapability": + return s.app.GetFreshVMCapability(), nil + case "GetVMState": + return s.app.GetVMState(), nil + case "TryInVMFresh": + var image string + if err := unmarshalStringParam(req.Params, &image); err != nil { + return nil, &jsonrpcError{Code: errCodeInvalidParams, Message: err.Error()} + } + if err := s.app.TryInVMFresh(image); err != nil { + return nil, &jsonrpcError{Code: errCodeInternal, Message: err.Error()} + } + return nil, nil + case "BootInVM", "StopVM", "ForceStopVM": + var err error + switch req.Method { + case "BootInVM": + err = s.app.BootInVM() + case "StopVM": + err = s.app.StopVM() + case "ForceStopVM": + err = s.app.ForceStopVM() + } + if err != nil { + return nil, &jsonrpcError{Code: errCodeInternal, Message: err.Error()} + } + return nil, nil + case "Shutdown": s.mu.Lock() s.shutdown = true @@ -323,6 +360,7 @@ func Serve(ctx context.Context, app *App, in io.Reader, out io.Writer) error { // Close the transport before waiting: a worker may be emitting progress // to a shell that has already gone away. syncWriter.stop() + app.shutdownVM() app.stopInstall(30*time.Second, func() { fmt.Fprintln(os.Stderr, "serve: installation is still stopping; waiting for disk/boot cleanup. Do not reboot.") }) diff --git a/app/tools/gendto/main.go b/app/tools/gendto/main.go index 58783c17..3f08bdca 100644 --- a/app/tools/gendto/main.go +++ b/app/tools/gendto/main.go @@ -34,6 +34,7 @@ var DTOStructs = []string{ "SessionExport", "VMEvent", "VMCapability", + "VMState", "BundleInfo", } diff --git a/app/vm_builder_result.go b/app/vm_builder_result.go new file mode 100644 index 00000000..c83eeed4 --- /dev/null +++ b/app/vm_builder_result.go @@ -0,0 +1,80 @@ +package main + +import ( + "bufio" + "encoding/json" + "fmt" + "io" + "strings" +) + +type vmBuilderReceipt struct { + Type string `json:"type"` + SchemaVersion int `json:"schemaVersion"` + Status string `json:"status"` + RunID string `json:"runId"` + InstallID string `json:"installId"` + Image string `json:"image"` + DiskID string `json:"diskId"` + FilesystemVerified bool `json:"filesystemVerified"` + EFIVerified bool `json:"efiVerified"` + AccountOutcome string `json:"accountOutcome"` +} + +func verifyVMBuilderReceipt(input io.Reader, expected VMState) (vmBuilderReceipt, error) { + var receipt vmBuilderReceipt + limited := &io.LimitedReader{R: input, N: (64 << 20) + 1} + scanner := bufio.NewScanner(limited) + scanner.Buffer(make([]byte, 4096), 1<<20) + count := 0 + success := false + failed := false + for scanner.Scan() { + line := strings.TrimSpace(scanner.Text()) + if line == "STATUS=SUCCESS" { + if count == 1 { + success = true + } + continue + } + var msg struct { + Type string `json:"type"` + Step string `json:"step"` + } + if json.Unmarshal([]byte(line), &msg) != nil { + continue + } + if msg.Step == "error" { + failed = true + } + if msg.Type == "result" { + count++ + if err := json.Unmarshal([]byte(line), &receipt); err != nil { + return receipt, err + } + } + } + if err := scanner.Err(); err != nil { + return receipt, err + } + if limited.N == 0 { + return receipt, fmt.Errorf("builder log exceeds size limit") + } + if failed || count != 1 || !success { + return receipt, fmt.Errorf("builder did not supply one completed, successful installation receipt") + } + if receipt.SchemaVersion != 1 || receipt.Status != "success" || receipt.RunID != expected.RunID || receipt.InstallID != expected.InstallID || receipt.Image != expected.Image { + return receipt, fmt.Errorf("builder result does not match this installation/run/image") + } + if !receipt.FilesystemVerified || !receipt.EFIVerified || receipt.AccountOutcome != "image-default" { + return receipt, fmt.Errorf("builder did not verify the filesystem, EFI boot, and account outcome") + } + diskID, err := vmDiskIdentity(expected.DiskPath) + if err != nil { + return receipt, err + } + if diskID != receipt.DiskID { + return receipt, fmt.Errorf("builder result names a different disk identity") + } + return receipt, nil +} diff --git a/app/vm_environment_windows.go b/app/vm_environment_windows.go new file mode 100644 index 00000000..7661c9ad --- /dev/null +++ b/app/vm_environment_windows.go @@ -0,0 +1,20 @@ +//go:build windows + +package main + +import ( + "golang.org/x/sys/windows" + "path/filepath" +) + +// An elevated QEMU must not inherit user DLL/plugin/config search overrides. +// Start with a whitelist; the system directory comes from the Windows API, +// never from a caller-controlled SystemRoot or PATH environment variable. +func vmProcessEnvironment(runtimeDir, tempDir string) []string { + system, err := windows.GetSystemDirectory() + if err != nil { + return []string{"PATH=" + runtimeDir, "TEMP=" + tempDir, "TMP=" + tempDir} + } + root := filepath.Dir(system) + return []string{"SystemRoot=" + root, "WINDIR=" + root, "PATH=" + runtimeDir + ";" + system, "TEMP=" + tempDir, "TMP=" + tempDir, "HOME=" + tempDir, "USERPROFILE=" + tempDir, "APPDATA=" + tempDir, "LOCALAPPDATA=" + tempDir} +} diff --git a/app/vm_guard.go b/app/vm_guard.go new file mode 100644 index 00000000..63a9a93d --- /dev/null +++ b/app/vm_guard.go @@ -0,0 +1,30 @@ +package main + +import ( + "fmt" + "os" + "path/filepath" +) + +func vmStatePath(root string) string { return filepath.Join(root, "vm", "state.json") } + +// Native install must not turn VM-first into a fresh deployment of the same +// disk. Promotion needs its separate verified transition; until then refuse. +func acquireNativeInstallLease(root string) (func(), error) { + release, err := acquireVMLock(filepath.Join(root, "disks", "root.disk")) + if err != nil { + return nil, err + } + if _, err = os.Lstat(vmStatePath(root)); !os.IsNotExist(err) { + release() + if err != nil { + return nil, err + } + return nil, fmt.Errorf("this disk belongs to a managed VM; native promotion must preserve that system and is not available yet") + } + if err = verifyVMDiskReleased(filepath.Join(root, "disks", "root.disk")); err != nil { + release() + return nil, err + } + return release, nil +} diff --git a/app/vm_image_windows.go b/app/vm_image_windows.go new file mode 100644 index 00000000..725db126 --- /dev/null +++ b/app/vm_image_windows.go @@ -0,0 +1,46 @@ +//go:build windows + +package main + +import ( + "fmt" + "golang.org/x/sys/windows" + "os" + "path/filepath" +) + +func createVMImageFiles() error { + root, _ := windows.UTF16PtrFromString(wootcDir()) + var available, total, free uint64 + if err := windows.GetDiskFreeSpaceEx(root, &available, &total, &free); err != nil { + return err + } + const capacity = uint64(40) << 30 + if available < 2*capacity { + return fmt.Errorf("VM preparation needs at least 80 GB free for the Linux disk and separate scratch space") + } + for _, path := range []string{managedVMRootDisk(), filepath.Join(previewDir(), "scratch.disk")} { + file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0600) + if err != nil { + return err + } + var returned uint32 + // Sparse files are safe here: QEMU uses Windows file APIs. Native promotion + // must separately prove allocation/NTFS compatibility before mounting offline. + err = windows.DeviceIoControl(windows.Handle(file.Fd()), windows.FSCTL_SET_SPARSE, nil, 0, nil, 0, &returned, nil) + if err == nil { + err = file.Truncate(int64(capacity)) + } + if err == nil { + err = file.Sync() + } + closeErr := file.Close() + if err != nil { + return err + } + if closeErr != nil { + return closeErr + } + } + return nil +} diff --git a/app/vm_job_windows.go b/app/vm_job_windows.go new file mode 100644 index 00000000..9dcd4a1f --- /dev/null +++ b/app/vm_job_windows.go @@ -0,0 +1,37 @@ +//go:build windows + +package main + +import ( + "golang.org/x/sys/windows" + "io" + "os/exec" + "unsafe" +) + +type vmJob struct{ handle windows.Handle } + +func (j *vmJob) Close() error { return windows.CloseHandle(j.handle) } +func ownVMProcess(cmd *exec.Cmd) (io.Closer, error) { + job, err := windows.CreateJobObject(nil, nil) + if err != nil { + return nil, err + } + info := windows.JOBOBJECT_EXTENDED_LIMIT_INFORMATION{} + info.BasicLimitInformation.LimitFlags = windows.JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE + if _, err = windows.SetInformationJobObject(job, windows.JobObjectExtendedLimitInformation, uintptr(unsafe.Pointer(&info)), uint32(unsafe.Sizeof(info))); err != nil { + windows.CloseHandle(job) + return nil, err + } + process, err := windows.OpenProcess(windows.PROCESS_SET_QUOTA|windows.PROCESS_TERMINATE, false, uint32(cmd.Process.Pid)) + if err != nil { + windows.CloseHandle(job) + return nil, err + } + defer windows.CloseHandle(process) + if err = windows.AssignProcessToJobObject(job, process); err != nil { + windows.CloseHandle(job) + return nil, err + } + return &vmJob{handle: job}, nil +} diff --git a/app/vm_job_windows_test.go b/app/vm_job_windows_test.go new file mode 100644 index 00000000..a0ed3772 --- /dev/null +++ b/app/vm_job_windows_test.go @@ -0,0 +1,65 @@ +//go:build windows + +package main + +import ( + "bufio" + "fmt" + "os" + "os/exec" + "strings" + "testing" + "time" +) + +func TestVMOwnedJobReapsChildOnClose(t *testing.T) { + if os.Getenv("WOOTC_TEST_JOB_CHILD") == "1" { + fmt.Println("child-running") + time.Sleep(time.Minute) + os.Exit(0) + } + cmd := exec.Command(os.Args[0], "-test.run=^TestVMOwnedJobReapsChildOnClose$") + cmd.Env = append(os.Environ(), "WOOTC_TEST_JOB_CHILD=1") + output, err := cmd.StdoutPipe() + if err != nil { + t.Fatal(err) + } + if err := cmd.Start(); err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = cmd.Process.Kill() }) + job, err := ownVMProcess(cmd) + if err != nil { + cmd.Process.Kill() + cmd.Wait() + t.Fatal(err) + } + reader := bufio.NewReader(output) + if line, err := reader.ReadString('\n'); err != nil || strings.TrimSpace(line) != "child-running" { + job.Close() + cmd.Wait() + t.Fatalf("child never became active: %q %v", line, err) + } + if err := job.Close(); err != nil { + t.Fatal(err) + } + exited := make(chan error, 1) + go func() { exited <- cmd.Wait() }() + select { + case <-exited: // Windows may report exit code zero for job termination. + case <-time.After(5 * time.Second): + t.Fatal("owned child survived engine job closure") + } +} + +func TestVMEnvironmentDoesNotInheritUserPluginPaths(t *testing.T) { + t.Setenv("GTK_PATH", `C:\Users\attacker`) + t.Setenv("QEMU_MODULE_DIR", `C:\Users\attacker`) + t.Setenv("PATH", `C:\Users\attacker`) + env := vmProcessEnvironment(`C:\wootc\qemu`, `C:\wootc\vm`) + for _, value := range env { + if strings.Contains(value, "attacker") { + t.Fatalf("inherited user search override: %s", value) + } + } +} diff --git a/app/vm_lifecycle.go b/app/vm_lifecycle.go new file mode 100644 index 00000000..31ea04c1 --- /dev/null +++ b/app/vm_lifecycle.go @@ -0,0 +1,126 @@ +package main + +import ( + "encoding/binary" + "encoding/hex" + "encoding/json" + "fmt" + "io" + "os" + "path/filepath" + "time" +) + +const ( + vmPreparing = "preparing" + vmReady = "ready" + vmStarting = "starting" + vmRunning = "running" + vmStopping = "stopping" + vmStopped = "stopped" + vmRecovery = "needs_recovery" + vmFailed = "failed" +) + +// VMState records the persistent installed system, not just a process. Ready +// means provisioning verified the disk; DesktopReady needs separate guest proof. +type VMState struct { + SchemaVersion int `json:"schemaVersion"` + InstallID string `json:"installId"` + RunID string `json:"runId"` + Image string `json:"image"` + DiskID string `json:"diskId"` + DiskPath string `json:"diskPath"` + Phase string `json:"phase"` + DesktopReady bool `json:"desktopReady"` + PID int `json:"pid"` + Error string `json:"error,omitempty"` + UpdatedAt string `json:"updatedAt"` +} + +func readVMState(path string) (VMState, error) { + var state VMState + f, err := os.Open(path) + if err != nil { + return state, err + } + defer f.Close() + if err = json.NewDecoder(io.LimitReader(f, 64*1024)).Decode(&state); err != nil { + return state, fmt.Errorf("read VM lifecycle: %w", err) + } + if state.SchemaVersion != 1 || state.InstallID == "" || state.DiskPath == "" { + return state, fmt.Errorf("invalid VM lifecycle identity") + } + return state, nil +} + +func writeVMState(path string, state VMState) error { + state.SchemaVersion = 1 + state.UpdatedAt = time.Now().UTC().Format(time.RFC3339Nano) + // Never turn process or QMP liveness into a claim about a usable desktop. + state.DesktopReady = false + data, err := json.MarshalIndent(state, "", " ") + if err != nil { + return err + } + if err = os.MkdirAll(filepath.Dir(path), 0700); err != nil { + return err + } + temp, err := os.CreateTemp(filepath.Dir(path), ".vm-state-") + if err != nil { + return err + } + name := temp.Name() + defer os.Remove(name) + if _, err = temp.Write(data); err != nil { + temp.Close() + return err + } + if err = temp.Sync(); err != nil { + temp.Close() + return err + } + if err = temp.Close(); err != nil { + return err + } + return os.Rename(name, path) +} + +// The GPT disk GUID ties a helper's result and later VM launches to the same +// image. A preallocated file, process PID, or matching file size is insufficient. +func vmDiskIdentity(path string) (string, error) { + file, err := os.Open(path) + if err != nil { + return "", err + } + defer file.Close() + header := make([]byte, 92) + if _, err = file.ReadAt(header, 512); err != nil { + return "", err + } + if string(header[:8]) != "EFI PART" { + return "", fmt.Errorf("VM disk has no GPT header") + } + guid := header[56:72] + if hex.EncodeToString(guid) == "00000000000000000000000000000000" { + return "", fmt.Errorf("VM disk has no identity") + } + return fmt.Sprintf("%08x-%04x-%04x-%x-%x", binary.LittleEndian.Uint32(guid), binary.LittleEndian.Uint16(guid[4:]), binary.LittleEndian.Uint16(guid[6:]), guid[8:10], guid[10:]), nil +} + +func vmLaunchAllowed(state VMState, diskPath string) error { + if state.Phase != vmReady && state.Phase != vmStopped { + return fmt.Errorf("VM cannot start from %s; preserve its disk and resolve recovery first", state.Phase) + } + if filepath.Clean(state.DiskPath) != filepath.Clean(diskPath) { + return fmt.Errorf("VM disk path differs from its recorded installation") + } + actual, err := vmDiskIdentity(diskPath) + if err != nil { + return err + } + if actual != state.DiskID { + return fmt.Errorf("VM disk identity changed; refusing to boot another disk") + } + return nil +} diff --git a/app/vm_lifecycle_test.go b/app/vm_lifecycle_test.go new file mode 100644 index 00000000..fc23c419 --- /dev/null +++ b/app/vm_lifecycle_test.go @@ -0,0 +1,94 @@ +package main + +import ( + "encoding/json" + "os" + "path/filepath" + "strings" + "testing" +) + +func vmTestDisk(t *testing.T) (string, string) { + t.Helper() + path := filepath.Join(t.TempDir(), "root.disk") + data := make([]byte, 1024) + copy(data[512:], "EFI PART") + copy(data[568:], []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}) + if err := os.WriteFile(path, data, 0600); err != nil { + t.Fatal(err) + } + id, err := vmDiskIdentity(path) + if err != nil { + t.Fatal(err) + } + return path, id +} +func TestVMReceiptRejectsProxySuccess(t *testing.T) { + path, id := vmTestDisk(t) + state := VMState{RunID: "run-12345", InstallID: "install-123", Image: "repo@sha256:abc", DiskPath: path} + good := vmBuilderReceipt{Type: "result", SchemaVersion: 1, Status: "success", RunID: state.RunID, InstallID: state.InstallID, Image: state.Image, DiskID: id, FilesystemVerified: true, EFIVerified: true, AccountOutcome: "image-default"} + for _, which := range []string{"good", "only-marker", "wrong-run", "wrong-image", "wrong-disk", "no-efi", "duplicate", "late-error", "early-marker"} { + t.Run(which, func(t *testing.T) { + receipt := good + switch which { + case "wrong-run": + receipt.RunID = "another-run" + case "wrong-image": + receipt.Image = "another-image" + case "wrong-disk": + receipt.DiskID = "another-disk" + case "no-efi": + receipt.EFIVerified = false + } + data, _ := json.Marshal(receipt) + log := string(data) + "\nSTATUS=SUCCESS\n" + switch which { + case "only-marker": + log = "STATUS=SUCCESS\n" + case "duplicate": + log += string(data) + "\n" + case "late-error": + log += "{\"step\":\"error\"}\n" + case "early-marker": + log = "STATUS=SUCCESS\n" + string(data) + "\n" + } + _, err := verifyVMBuilderReceipt(strings.NewReader(log), state) + if (err == nil) != (which == "good") { + t.Fatalf("verification error = %v", err) + } + }) + } +} +func TestVMDurableStateAndNativeWriterGuard(t *testing.T) { + root := t.TempDir() + path, id := vmTestDisk(t) + state := VMState{InstallID: "install-123", RunID: "run-12345", DiskPath: path, DiskID: id, Phase: vmStopped, DesktopReady: true} + if err := writeVMState(vmStatePath(root), state); err != nil { + t.Fatal(err) + } + got, err := readVMState(vmStatePath(root)) + if err != nil { + t.Fatal(err) + } + if got.DesktopReady { + t.Fatal("durable state claims desktop without guest evidence") + } + if err := vmLaunchAllowed(got, path); err != nil { + t.Fatal(err) + } + for _, phase := range []string{vmPreparing, vmRunning, vmStarting, vmStopping, vmRecovery, vmFailed} { + got.Phase = phase + if vmLaunchAllowed(got, path) == nil { + t.Errorf("launched %s", phase) + } + } + if release, err := acquireNativeInstallLease(root); err == nil { + release() + t.Fatal("native redeploy accepted managed image") + } + got.Phase = vmStopped + got.DiskID = "different" + if vmLaunchAllowed(got, path) == nil { + t.Fatal("changed disk accepted") + } +} diff --git a/app/vm_lock_other.go b/app/vm_lock_other.go new file mode 100644 index 00000000..a6e99682 --- /dev/null +++ b/app/vm_lock_other.go @@ -0,0 +1,31 @@ +//go:build !windows + +package main + +import ( + "crypto/sha256" + "fmt" + "os" + "path/filepath" + "sync" + "syscall" +) + +func acquireVMLock(disk string) (func(), error) { + path, err := filepath.Abs(disk) + if err != nil { + return nil, err + } + hash := sha256.Sum256([]byte(path)) + f, err := os.OpenFile(filepath.Join(os.TempDir(), fmt.Sprintf("wootc-image-%x.lock", hash)), os.O_CREATE|os.O_RDWR, 0600) + if err != nil { + return nil, err + } + if err = syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil { + f.Close() + return nil, fmt.Errorf("Linux disk is in use: %w", err) + } + var once sync.Once + return func() { once.Do(func() { _ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN); _ = f.Close() }) }, nil +} +func verifyVMDiskReleased(string) error { return nil } diff --git a/app/vm_lock_windows.go b/app/vm_lock_windows.go new file mode 100644 index 00000000..8b87ea42 --- /dev/null +++ b/app/vm_lock_windows.go @@ -0,0 +1,83 @@ +//go:build windows + +package main + +import ( + "crypto/sha256" + "fmt" + "path/filepath" + "runtime" + "strings" + "sync" + "unsafe" + + "golang.org/x/sys/windows" +) + +// Mutex ownership is thread-bound on Windows. A dedicated pinned goroutine +// retains it until release, including across a QEMU process lifetime. The +// kernel abandons the mutex after an engine crash; durable VM state still +// blocks an automatic restart of an image that may have been interrupted. +func acquireVMLock(disk string) (func(), error) { + path, err := filepath.Abs(disk) + if err != nil { + return nil, err + } + hash := sha256.Sum256([]byte(strings.ToUpper(filepath.Clean(path)))) + name, _ := windows.UTF16PtrFromString(fmt.Sprintf(`Global\wootc-image-%x`, hash)) + ready := make(chan error, 1) + release := make(chan struct{}) + done := make(chan struct{}) + go func() { + runtime.LockOSThread() + defer runtime.UnlockOSThread() + defer close(done) + sd, err := windows.SecurityDescriptorFromString("D:P(A;;GA;;;SY)(A;;GA;;;BA)") + if err != nil { + ready <- err + return + } + attr := windows.SecurityAttributes{Length: uint32(unsafe.Sizeof(windows.SecurityAttributes{})), SecurityDescriptor: sd} + handle, err := windows.CreateMutex(&attr, false, name) + if err != nil && err != windows.ERROR_ALREADY_EXISTS { + ready <- err + return + } + defer windows.CloseHandle(handle) + result, err := windows.WaitForSingleObject(handle, 0) + if err != nil { + ready <- err + return + } + if result != windows.WAIT_OBJECT_0 && result != windows.WAIT_ABANDONED { + ready <- fmt.Errorf("this Linux disk is in use by another operation or VM") + return + } + ready <- nil + <-release + _ = windows.ReleaseMutex(handle) + }() + if err := <-ready; err != nil { + <-done + return nil, err + } + var once sync.Once + return func() { once.Do(func() { close(release); <-done }) }, nil +} + +// Called while holding the image lease. It also catches a QEMU process left +// alive outside our manager: Windows must permit an exclusive image handle. +func verifyVMDiskReleased(path string) error { + ptr, err := windows.UTF16PtrFromString(path) + if err != nil { + return err + } + h, err := windows.CreateFile(ptr, windows.GENERIC_READ, 0, nil, windows.OPEN_EXISTING, windows.FILE_ATTRIBUTE_NORMAL, 0) + if err == windows.ERROR_FILE_NOT_FOUND || err == windows.ERROR_PATH_NOT_FOUND { + return nil + } + if err != nil { + return fmt.Errorf("Linux disk still has open handles; stop its VM first: %w", err) + } + return windows.CloseHandle(h) +} diff --git a/app/vm_managed_windows.go b/app/vm_managed_windows.go new file mode 100644 index 00000000..0cbbb8c5 --- /dev/null +++ b/app/vm_managed_windows.go @@ -0,0 +1,182 @@ +//go:build windows + +package main + +import ( + "context" + "fmt" + "os" + "os/exec" + "path/filepath" + "syscall" + "time" +) + +func (a *App) GetVMState() VMState { + a.vmMu.Lock() + defer a.vmMu.Unlock() + if a.vmSession != nil { + return a.vmSession.snapshot() + } + state, err := readVMState(vmStatePath(wootcDir())) + if os.IsNotExist(err) { + return VMState{SchemaVersion: 1, Phase: "absent"} + } + if err != nil { + return VMState{SchemaVersion: 1, Phase: vmRecovery, Error: err.Error()} + } + switch state.Phase { + case vmRunning, vmStarting, vmStopping, vmPreparing: + if a.vmCancel != nil { + return state + } + state.Phase = vmRecovery + state.Error = "The previous VM session did not record a clean stop. Its disk is preserved; check it before reuse." + } + state.DesktopReady = false + return state +} + +func (a *App) StopVM() error { + a.vmMu.Lock() + session := a.vmSession + a.vmMu.Unlock() + if session == nil { + return fmt.Errorf("no VM is owned by this engine; inspect its recorded state before reuse") + } + ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second) + defer cancel() + return session.stop(ctx) +} + +// ForceStopVM is a separate explicit action. It never changes the image back +// to ready: an interrupted filesystem needs its own recovery check. +func (a *App) ForceStopVM() error { + a.vmMu.Lock() + session := a.vmSession + cancel := a.vmCancel + done := a.vmPrepareDone + a.vmMu.Unlock() + if cancel != nil { + cancel() + if done != nil { + <-done + } + a.vmMu.Lock() + session = a.vmSession + a.vmMu.Unlock() + if session != nil { + return session.force() + } + return nil + } + if session == nil { + return fmt.Errorf("no active VM is owned by this engine") + } + return session.force() +} + +func (a *App) shutdownVM() { + a.vmMu.Lock() + cancel := a.vmCancel + done := a.vmPrepareDone + a.vmMu.Unlock() + if cancel != nil { + cancel() + if done != nil { + <-done + } + } + a.vmMu.Lock() + session := a.vmSession + a.vmMu.Unlock() + if session != nil { + ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second) + err := session.stop(ctx) + cancel() + if err != nil { + _ = session.force() + } + } +} + +func managedVMRootDisk() string { return filepath.Join(wootcDir(), "disks", "root.disk") } +func managedVMVars() string { return filepath.Join(wootcDir(), "vm", "firmware-vars.fd") } +func edk2VarsTemplate() string { return filepath.Join(qemuDir(), "share", "edk2-i386-vars.fd") } + +func createVMVars() error { + if _, err := os.Stat(managedVMVars()); err == nil { + return nil + } else if !os.IsNotExist(err) { + return err + } + data, err := os.ReadFile(edk2VarsTemplate()) + if err != nil { + return err + } + f, err := os.CreateTemp(filepath.Dir(managedVMVars()), ".firmware-vars-") + if err != nil { + return err + } + defer os.Remove(f.Name()) + if _, err = f.Write(data); err != nil { + f.Close() + return err + } + if err = f.Sync(); err != nil { + f.Close() + return err + } + if err = f.Close(); err != nil { + return err + } + return os.Rename(f.Name(), managedVMVars()) +} + +// launchManagedDesktop consumes the already-acquired image lease. Every launch +// reuses both the raw image and firmware variables; neither is recreated. +func (a *App) launchManagedDesktop(cap VMCapability, state VMState, release func()) error { + if err := vmLaunchAllowed(state, managedVMRootDisk()); err != nil { + return err + } + if err := verifyVMDiskReleased(state.DiskPath); err != nil { + return err + } + if err := createVMVars(); err != nil { + return fmt.Errorf("prepare persistent VM firmware: %w", err) + } + memory, cpus, err := vmResourceBudget(getSystemInfo().RAMGB) + if err != nil { + return err + } + args := []string{"-accel", cap.Accelerator, "-machine", "q35", "-cpu", "max", "-m", fmt.Sprint(memory), "-smp", fmt.Sprint(cpus), + "-drive", vmDiskDrive(state.DiskPath), + "-drive", "if=pflash,format=raw,readonly=on,file=" + qemuEscape(edk2Code()), + "-drive", "if=pflash,format=raw,file=" + qemuEscape(managedVMVars()), + "-nic", "user", "-display", "gtk", "-qmp", "stdio", "-monitor", "none", + "-name", effectiveBranding().Name + " (VM)"} + cmd := exec.Command(cap.QEMUPath, args...) + cmd.Dir = filepath.Dir(cap.QEMUPath) + cmd.Env = vmProcessEnvironment(cmd.Dir, previewDir()) + cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true} + log, err := os.OpenFile(filepath.Join(wootcDir(), "vm", "qemu.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) + if err != nil { + return err + } + cmd.Stderr = log + session, err := startManagedVM(cmd, vmStatePath(wootcDir()), state, release, ownVMProcess) + if err != nil { + log.Close() + return err + } + a.vmMu.Lock() + a.vmSession = session + a.vmMu.Unlock() + go func() { + <-session.done + log.Close() + state := session.snapshot() + a.emitVM(VMEvent{Stage: state.Phase, Message: state.Error}) + }() + return nil +} diff --git a/app/vm_other.go b/app/vm_other.go index 43b45a88..a8544f8c 100644 --- a/app/vm_other.go +++ b/app/vm_other.go @@ -34,3 +34,10 @@ func (a *App) TryInVMFresh(imageRef string) error { func (a *App) InstallPreviewForReal(cfg InstallConfig) error { return fmt.Errorf("Try in VM is only available on Windows") } + +func (a *App) GetVMState() VMState { + return VMState{SchemaVersion: 1, Phase: "unavailable", Error: "Managed VMs are only available on Windows."} +} +func (a *App) StopVM() error { return fmt.Errorf("managed VMs are only available on Windows") } +func (a *App) ForceStopVM() error { return fmt.Errorf("managed VMs are only available on Windows") } +func (a *App) shutdownVM() {} diff --git a/app/vm_process.go b/app/vm_process.go new file mode 100644 index 00000000..21ccbc45 --- /dev/null +++ b/app/vm_process.go @@ -0,0 +1,172 @@ +package main + +import ( + "context" + "fmt" + "io" + "os" + "os/exec" + "sync" + "time" +) + +type vmSession struct { + mu sync.Mutex + state VMState + statePath string + cmd *exec.Cmd + qmp *qmpClient + job io.Closer + done chan struct{} + release func() + forced bool + output *os.File +} + +func startManagedVM(cmd *exec.Cmd, statePath string, state VMState, release func(), own func(*exec.Cmd) (io.Closer, error)) (*vmSession, error) { + session := &vmSession{state: state, statePath: statePath, cmd: cmd, release: release, done: make(chan struct{})} + session.state.Phase = vmStarting + session.state.PID = 0 + session.state.Error = "" + if err := writeVMState(statePath, session.state); err != nil { + return nil, err + } + childInput, input, err := os.Pipe() + if err != nil { + return nil, err + } + output, childOutput, err := os.Pipe() + if err != nil { + childInput.Close() + input.Close() + return nil, err + } + cmd.Stdin = childInput + cmd.Stdout = childOutput + session.output = output + if err = cmd.Start(); err != nil { + childInput.Close() + input.Close() + output.Close() + childOutput.Close() + return nil, err + } + childInput.Close() + childOutput.Close() + session.job, err = own(cmd) + if err == nil { + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + session.qmp, err = connectQMP(ctx, input, output) + cancel() + } + if err != nil { + input.Close() + _ = cmd.Process.Kill() + _ = cmd.Wait() + output.Close() + if session.job != nil { + session.job.Close() + } + session.state.Phase = vmRecovery + session.state.Error = err.Error() + _ = writeVMState(statePath, session.state) + return nil, fmt.Errorf("VM control initialization failed: %w", err) + } + session.state.Phase = vmRunning + session.state.PID = cmd.Process.Pid + if err = writeVMState(statePath, session.state); err != nil { + _ = cmd.Process.Kill() + _ = cmd.Wait() + session.qmp.input.Close() + output.Close() + session.job.Close() + return nil, err + } + go session.wait() + return session, nil +} + +func (s *vmSession) wait() { + waitErr := s.cmd.Wait() + _ = s.job.Close() // Close descendant handles before draining QMP EOF. + // The parent closed its copy of the child's write handle immediately after + // Start. Drain the actual EOF before deciding whether SHUTDOWN was observed. + <-s.qmp.done + _ = s.output.Close() + _ = s.qmp.input.Close() + s.mu.Lock() + s.state.PID = 0 + s.state.DesktopReady = false + if waitErr == nil && s.qmp.clean() && !s.forced { + s.state.Phase = vmStopped + s.state.Error = "" + } else { + s.state.Phase = vmRecovery + s.state.Error = "The VM stopped without verified guest shutdown. Its disk is preserved; check it before reuse." + if waitErr != nil { + s.state.Error += " " + waitErr.Error() + } + } + if err := writeVMState(s.statePath, s.state); err != nil { + s.state.Phase = vmRecovery + s.state.Error = fmt.Sprintf("could not record VM shutdown: %v", err) + } + s.mu.Unlock() + s.release() + close(s.done) +} + +func (s *vmSession) snapshot() VMState { s.mu.Lock(); defer s.mu.Unlock(); return s.state } + +func (s *vmSession) stop(ctx context.Context) error { + select { + case <-s.done: + if state := s.snapshot(); state.Phase != vmStopped { + return fmt.Errorf("%s", state.Error) + } + return nil + default: + } + s.mu.Lock() + if s.state.Phase == vmStopped || s.state.Phase == vmRecovery { + state := s.state + s.mu.Unlock() + if state.Phase == vmStopped { + return nil + } + return fmt.Errorf("%s", state.Error) + } + s.state.Phase = vmStopping + err := writeVMState(s.statePath, s.state) + s.mu.Unlock() + if err != nil { + return err + } + if err = s.qmp.command(ctx, "system_powerdown"); err != nil { + return fmt.Errorf("request clean guest shutdown: %w", err) + } + select { + case <-s.done: + state := s.snapshot() + if state.Phase != vmStopped { + return fmt.Errorf("%s", state.Error) + } + return nil + case <-ctx.Done(): + return fmt.Errorf("Linux has not completed shutdown; its disk remains locked: %w", ctx.Err()) + } +} + +func (s *vmSession) force() error { + select { + case <-s.done: + return nil + default: + } + s.mu.Lock() + s.forced = true + s.mu.Unlock() + err := s.cmd.Process.Kill() + <-s.done + return err +} diff --git a/app/vm_process_test.go b/app/vm_process_test.go new file mode 100644 index 00000000..66d9881b --- /dev/null +++ b/app/vm_process_test.go @@ -0,0 +1,134 @@ +package main + +import ( + "bufio" + "context" + "encoding/json" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "testing" + "time" +) + +type noopVMJob struct{} + +func (noopVMJob) Close() error { return nil } + +// A real child process exercises inherited handles, QMP negotiation, observed +// shutdown, and actual process reaping rather than mocking a completion flag. +func TestVMQMPChild(t *testing.T) { + mode := os.Getenv("WOOTC_TEST_QMP_CHILD") + if mode == "" { + return + } + fmt.Println(`{"QMP":{"version":{},"capabilities":[]}}`) + scanner := bufio.NewScanner(os.Stdin) + for scanner.Scan() { + var request map[string]string + if json.Unmarshal(scanner.Bytes(), &request) != nil { + os.Exit(8) + } + fmt.Printf("{\"return\":{},\"id\":%q}\n", request["id"]) + if request["execute"] == "system_powerdown" { + switch mode { + case "clean": + fmt.Println(`{"event":"SHUTDOWN","data":{"guest":true,"reason":"guest-shutdown"}}`) + os.Exit(0) + case "host": + fmt.Println(`{"event":"SHUTDOWN","data":{"guest":false,"reason":"host-qmp-quit"}}`) + os.Exit(0) + case "crash": + os.Exit(9) + case "hung": // A responsive QMP endpoint is not proof of guest shutdown. + } + } + } + os.Exit(7) +} + +func TestManagedVMShutdownContract(t *testing.T) { + for _, mode := range []string{"clean", "host", "crash", "hung"} { + t.Run(mode, func(t *testing.T) { + root := t.TempDir() + disk := filepath.Join(root, "root.disk") + if err := os.WriteFile(disk, []byte("persistent user data"), 0600); err != nil { + t.Fatal(err) + } + lease, err := acquireVMLock(disk) + if err != nil { + t.Fatal(err) + } + released := make(chan struct{}) + cmd := exec.Command(os.Args[0], "-test.run=^TestVMQMPChild$") + cmd.Env = append(os.Environ(), "WOOTC_TEST_QMP_CHILD="+mode) + statePath := filepath.Join(root, "state.json") + state := VMState{InstallID: "install-123", DiskPath: disk, Phase: vmReady} + session, err := startManagedVM(cmd, statePath, state, func() { lease(); close(released) }, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if err != nil { + lease() + t.Fatal(err) + } + t.Cleanup(func() { _ = session.force() }) + if _, err := acquireVMLock(disk); err == nil { + t.Fatal("running image accepted a second writer") + } + if session.snapshot().DesktopReady { + t.Fatal("QMP liveness became desktop readiness") + } + timeout := 5 * time.Second + if mode == "hung" { + timeout = 150 * time.Millisecond + } + ctx, cancel := context.WithTimeout(context.Background(), timeout) + defer cancel() + err = session.stop(ctx) + if mode == "clean" && err != nil { + t.Fatal(err) + } + if mode != "clean" && err == nil { + t.Fatal("unverified shutdown accepted") + } + if mode == "hung" { + select { + case <-released: + t.Fatal("timed-out guest lost writer protection") + default: + } + if _, err := acquireVMLock(disk); err == nil { + t.Fatal("hung guest accepted a writer") + } + if err := session.force(); err != nil { + t.Fatal(err) + } + } + select { + case <-session.done: + case <-time.After(5 * time.Second): + t.Fatal("child not reaped") + } + got, err := readVMState(statePath) + if err != nil { + t.Fatal(err) + } + want := vmRecovery + if mode == "clean" { + want = vmStopped + } + if got.Phase != want || got.PID != 0 || got.DesktopReady { + t.Fatalf("state = %+v", got) + } + next, err := acquireVMLock(disk) + if err != nil { + t.Fatal(err) + } + next() + data, err := os.ReadFile(disk) + if err != nil || string(data) != "persistent user data" { + t.Fatalf("disk changed: %q %v", data, err) + } + }) + } +} diff --git a/app/vm_qmp.go b/app/vm_qmp.go new file mode 100644 index 00000000..534688df --- /dev/null +++ b/app/vm_qmp.go @@ -0,0 +1,146 @@ +package main + +import ( + "bufio" + "context" + "encoding/json" + "fmt" + "io" + "strconv" + "sync" +) + +// qmpClient owns a private inherited pipe pair. There is no public listener or +// command port for another user/process to connect to. +type qmpClient struct { + input io.WriteCloser + mu sync.Mutex + writeMu sync.Mutex + next uint64 + pending map[string]chan error + done chan struct{} + greeting chan error + cleanShutdown bool + err error +} + +func connectQMP(ctx context.Context, input io.WriteCloser, output io.Reader) (*qmpClient, error) { + q := &qmpClient{input: input, pending: map[string]chan error{}, done: make(chan struct{}), greeting: make(chan error, 1)} + go q.read(output) + select { + case err := <-q.greeting: + if err != nil { + return nil, err + } + case <-ctx.Done(): + input.Close() + return nil, ctx.Err() + } + if err := q.command(ctx, "qmp_capabilities"); err != nil { + input.Close() + return nil, err + } + return q, nil +} + +func (q *qmpClient) read(output io.Reader) { + scanner := bufio.NewScanner(output) + scanner.Buffer(make([]byte, 4096), 1024*1024) + first := true + var readErr error + for scanner.Scan() { + var packet struct { + QMP json.RawMessage `json:"QMP"` + ID string `json:"id"` + Event string `json:"event"` + Data struct { + Guest bool `json:"guest"` + Reason string `json:"reason"` + } `json:"data"` + Error *struct { + Class string `json:"class"` + Desc string `json:"desc"` + } `json:"error"` + } + if err := json.Unmarshal(scanner.Bytes(), &packet); err != nil { + readErr = fmt.Errorf("invalid QMP response: %w", err) + break + } + if first { + if len(packet.QMP) == 0 { + readErr = fmt.Errorf("QMP greeting missing") + break + } + first = false + q.greeting <- nil + continue + } + q.mu.Lock() + if packet.Event == "SHUTDOWN" && packet.Data.Guest && packet.Data.Reason == "guest-shutdown" { + q.cleanShutdown = true + } + if waiter, ok := q.pending[packet.ID]; ok { + delete(q.pending, packet.ID) + if packet.Error != nil { + waiter <- fmt.Errorf("QMP %s: %s", packet.Error.Class, packet.Error.Desc) + } else { + waiter <- nil + } + } + q.mu.Unlock() + } + if readErr == nil { + readErr = scanner.Err() + } + if readErr == nil { + readErr = io.EOF + } + q.mu.Lock() + q.err = readErr + for id, waiter := range q.pending { + waiter <- readErr + delete(q.pending, id) + } + q.mu.Unlock() + if first { + q.greeting <- readErr + } + close(q.done) +} + +func (q *qmpClient) command(ctx context.Context, command string) error { + q.mu.Lock() + if q.err != nil { + err := q.err + q.mu.Unlock() + return err + } + q.next++ + id := strconv.FormatUint(q.next, 10) + waiter := make(chan error, 1) + q.pending[id] = waiter + q.mu.Unlock() + message, _ := json.Marshal(map[string]string{"execute": command, "id": id}) + stopCancel := context.AfterFunc(ctx, func() { _ = q.input.Close() }) + q.writeMu.Lock() + _, err := q.input.Write(append(message, '\n')) + q.writeMu.Unlock() + stopCancel() + if err != nil { + q.mu.Lock() + delete(q.pending, id) + q.mu.Unlock() + return err + } + select { + case err := <-waiter: + return err + case <-ctx.Done(): + q.mu.Lock() + delete(q.pending, id) + q.mu.Unlock() + return ctx.Err() + } +} + +func (q *qmpClient) clean() bool { q.mu.Lock(); defer q.mu.Unlock(); return q.cleanShutdown } diff --git a/app/vm_qmp_test.go b/app/vm_qmp_test.go new file mode 100644 index 00000000..7fff6622 --- /dev/null +++ b/app/vm_qmp_test.go @@ -0,0 +1,21 @@ +package main + +import ( + "context" + "io" + "strings" + "testing" + "time" +) + +func TestQMPRejectsMissingGreetingPromptly(t *testing.T) { + input, output := io.Pipe() + defer input.Close() + defer output.Close() + ctx, cancel := context.WithTimeout(context.Background(), time.Second) + defer cancel() + _, err := connectQMP(ctx, output, strings.NewReader("{\"return\":{}}\n")) + if err == nil || ctx.Err() != nil { + t.Fatalf("bad greeting did not fail promptly: %v", err) + } +} diff --git a/app/vm_resources.go b/app/vm_resources.go new file mode 100644 index 00000000..ffe88a7c --- /dev/null +++ b/app/vm_resources.go @@ -0,0 +1,28 @@ +package main + +import ( + "fmt" + "runtime" + "strings" +) + +func qemuEscape(path string) string { return strings.ReplaceAll(path, ",", ",,") } +func vmResourceBudget(hostGiB float64) (memoryMiB, cpus int, err error) { + // Keep at least half of host memory for Windows, with a 2 GiB guest floor. + // This is an allocation bound, not a claim about desktop responsiveness. + memoryMiB = int(hostGiB * 1024 / 2) + if memoryMiB < 2048 { + return 0, 0, fmt.Errorf("this VM requires at least 4 GB of host RAM; Windows must retain memory too") + } + if memoryMiB > 4096 { + memoryMiB = 4096 + } + cpus = runtime.NumCPU() - 1 + if cpus < 1 { + cpus = 1 + } + if cpus > 4 { + cpus = 4 + } + return memoryMiB, cpus, nil +} diff --git a/app/vm_runtime.go b/app/vm_runtime.go new file mode 100644 index 00000000..c9bb8bb6 --- /dev/null +++ b/app/vm_runtime.go @@ -0,0 +1,75 @@ +package main + +import ( + "crypto/sha256" + "encoding/hex" + "fmt" + "io" + "io/fs" + "os" + "path/filepath" + "strings" + "wootc/internal/artifactauth" +) + +// verifyVMRuntime authenticates the complete private runtime tree, including +// dependencies loaded by QEMU. Merely hashing the main executable is not enough. +// The release signer uses the same embedded key as boot artifacts. Canonical +// relative paths are matched exactly; case-insensitive collisions are rejected. +func verifyVMRuntime(root, publicKey string) error { + data, err := readLocalMetadata(filepath.Join(root, "SHA256SUMS"), artifactauth.MaxManifestSize) + if err != nil { + return fmt.Errorf("signed VM runtime manifest unavailable: %w", err) + } + sig, err := readLocalMetadata(filepath.Join(root, "SHA256SUMS.sig"), 64) + if err != nil { + return err + } + expected, err := artifactauth.Verify(publicKey, data, sig) + if err != nil { + return err + } + seen := map[string]bool{} + return filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error { + if walkErr != nil { + return walkErr + } + if entry.Type()&os.ModeSymlink != 0 { + return fmt.Errorf("runtime contains a symbolic link: %s", path) + } + if entry.IsDir() { + return nil + } + relative, err := filepath.Rel(root, path) + if err != nil { + return err + } + name := filepath.ToSlash(relative) + if path == filepath.Join(root, "SHA256SUMS") || path == filepath.Join(root, "SHA256SUMS.sig") { + return nil + } + folded := strings.ToLower(name) + if seen[folded] { + return fmt.Errorf("duplicate runtime path: %s", name) + } + seen[folded] = true + checksum, ok := expected[name] + if !ok { + return fmt.Errorf("runtime file is not signed: %s", name) + } + f, err := os.Open(path) + if err != nil { + return err + } + hash := sha256.New() + _, err = io.Copy(hash, f) + f.Close() + if err != nil { + return err + } + if hex.EncodeToString(hash.Sum(nil)) != checksum { + return fmt.Errorf("runtime checksum mismatch: %s", name) + } + return nil + }) +} diff --git a/app/vm_runtime_test.go b/app/vm_runtime_test.go new file mode 100644 index 00000000..6b758c95 --- /dev/null +++ b/app/vm_runtime_test.go @@ -0,0 +1,49 @@ +package main + +import ( + "crypto/ed25519" + "crypto/rand" + "crypto/sha256" + "encoding/hex" + "fmt" + "os" + "path/filepath" + "testing" + "wootc/internal/artifactauth" +) + +func TestVMRuntimeRequiresCompleteSignedClosure(t *testing.T) { + pub, private, err := ed25519.GenerateKey(rand.Reader) + if err != nil { + t.Fatal(err) + } + root := t.TempDir() + key := hex.EncodeToString(pub) + content := []byte("trusted-runtime") + manifest := []byte(fmt.Sprintf("%x qemu-system-x86_64.exe\n", sha256.Sum256(content))) + for name, data := range map[string][]byte{"qemu-system-x86_64.exe": content, "SHA256SUMS": manifest, "SHA256SUMS.sig": artifactauth.Sign(private, manifest)} { + if err := os.WriteFile(filepath.Join(root, name), data, 0600); err != nil { + t.Fatal(err) + } + } + if err := verifyVMRuntime(root, key); err != nil { + t.Fatal(err) + } + extra := filepath.Join(root, "ambient.dll") + if err := os.WriteFile(extra, []byte("unsigned"), 0600); err != nil { + t.Fatal(err) + } + if err := verifyVMRuntime(root, key); err == nil { + t.Fatal("unsigned DLL accepted") + } + os.Remove(extra) + os.WriteFile(filepath.Join(root, "qemu-system-x86_64.exe"), []byte("replaced"), 0600) + if err := verifyVMRuntime(root, key); err == nil { + t.Fatal("replacement executable accepted") + } + os.WriteFile(filepath.Join(root, "qemu-system-x86_64.exe"), content, 0600) + other, _, _ := ed25519.GenerateKey(rand.Reader) + if err := verifyVMRuntime(root, hex.EncodeToString(other)); err == nil { + t.Fatal("untrusted signing key accepted") + } +} diff --git a/app/vm_windows.go b/app/vm_windows.go index d9781a8d..96f46c04 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -3,8 +3,11 @@ package main import ( + "context" + "crypto/rand" + "encoding/hex" "fmt" - "net" + "net/http" "os" "os/exec" "path/filepath" @@ -17,8 +20,8 @@ import ( // window on Windows using WHPX acceleration — the user sees their Linux // system without rebooting. Same disk, same state as the dual-boot path. // -// QEMU-for-Windows + edk2 firmware are bundled under C:\wootc\qemu\ by the -// release. This code is the launcher + capability probe. +// The signed QEMU runtime and firmware are staged under C:\wootc\qemu. +// Standard releases do not yet supply that bundle; see docs/managed-vm.md. // VMCapability tells the GUI whether "Boot in VM" can run and why not. type VMCapability struct { @@ -32,51 +35,31 @@ type VMCapability struct { func qemuDir() string { return filepath.Join(wootcDir(), "qemu") } func qemuExe() string { return filepath.Join(qemuDir(), "qemu-system-x86_64.exe") } -func edk2Code() string { return filepath.Join(qemuDir(), "edk2-x86_64-code.fd") } +func edk2Code() string { return filepath.Join(qemuDir(), "share", "edk2-x86_64-code.fd") } // GetVMCapability reports whether the installed disk can be booted in a VM. func (a *App) GetVMCapability() VMCapability { - info := getUninstallInfo() // reuses root.disk discovery - if !info.Found { - return VMCapability{Available: false, Reason: "No installed Linux disk was found."} + cap := a.vmRuntimeCapability() + state := a.GetVMState() + cap.DiskPath = state.DiskPath + if state.Phase != vmReady && state.Phase != vmStopped { + cap.Available = false + cap.Reason = "No verified, stopped VM installation is ready. " + state.Error } - qemuPath, bundled := findQEMU() - if qemuPath == "" { - return VMCapability{Available: false, DiskPath: info.DiskPath, - Reason: "QEMU isn't installed. Install QEMU for Windows or reinstall wootc with the VM viewer."} - } - if _, err := os.Stat(edk2Code()); err != nil { - return VMCapability{Available: false, DiskPath: info.DiskPath, - QEMUPath: qemuPath, Bundled: bundled, - Reason: "The VM firmware is missing. Reinstall wootc with the VM viewer."} - } - accelerator := availableAccelerator() - if accelerator == "" { - return VMCapability{Available: false, DiskPath: info.DiskPath, - QEMUPath: qemuPath, Bundled: bundled, - Reason: "No supported VM accelerator is available. Enable Windows Hypervisor Platform in 'Turn Windows features on or off'."} - } - return VMCapability{Available: true, DiskPath: info.DiskPath, Accelerator: accelerator, QEMUPath: qemuPath, Bundled: bundled} + return cap } func findQEMU() (string, bool) { - if _, err := os.Stat(qemuExe()); err == nil { + if info, err := os.Stat(qemuExe()); err == nil && !info.IsDir() { return qemuExe(), true } - path, err := exec.LookPath("qemu-system-x86_64.exe") - if err != nil { - return "", false - } - return path, false + return "", false // never execute an arbitrary elevated binary from PATH } func availableAccelerator() string { if whpxAvailable() { return "whpx" } - if haxmAvailable() { - return "hax" - } return "" } @@ -88,25 +71,21 @@ func (a *App) BootInVM() error { if !cap.Available { return fmt.Errorf("%s", cap.Reason) } - args := []string{ - "-accel", cap.Accelerator, - "-m", "4G", "-smp", "4", - "-machine", "q35", - "-drive", vmDiskDrive(cap.DiskPath), - "-drive", "if=pflash,format=raw,readonly=on,file=" + edk2Code(), - "-nic", "user,hostfwd=tcp:127.0.0.1:2222-:22", - "-display", "gtk", - "-name", effectiveBranding().Name + " (VM)", - } - cmd := exec.Command(cap.QEMUPath, args...) - cmd.Dir = filepath.Dir(cap.QEMUPath) - cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: false} - if err := cmd.Start(); err != nil { - return fmt.Errorf("launching QEMU: %w", err) + if err := prepareTrustedStateTree(wootcDir()); err != nil { + return err } - // Detach: the VM window outlives this call. - go func() { _ = cmd.Wait() }() - return nil + release, err := acquireVMLock(managedVMRootDisk()) + if err != nil { + return err + } + state, err := readVMState(vmStatePath(wootcDir())) + if err == nil { + err = a.launchManagedDesktop(cap, state, release) + } + if err != nil { + release() + } + return err } // ── §6.1 Try in VM (fresh image, two-stage headless builder) ───────────────── @@ -116,20 +95,27 @@ func (a *App) BootInVM() error { // reboot, no BCD change. Native promotion remains gated until the same-image // lifecycle and shutdown contract in ADR 0004 is proven. -func previewDir() string { return filepath.Join(os.TempDir(), "wootc-preview") } -func previewRaw() string { return filepath.Join(previewDir(), "preview.raw") } +func previewDir() string { return filepath.Join(wootcDir(), "vm") } +func previewRaw() string { return managedVMRootDisk() } func builderKernel() string { return filepath.Join(qemuDir(), "builder-vmlinuz") } func builderInitrd() string { return filepath.Join(qemuDir(), "builder-initramfs.img") } -const previewIPCPort = 9099 - // GetFreshVMCapability reports whether "Try in VM" (fresh build) can run. It // needs QEMU + firmware + an accelerator (like §6.2) plus the bundled Alpine // builder kernel/initramfs that does the OCI→disk work. // VM-first is the required product direction (ADR 0004). Current standard // releases still lack a proven runtime/builder bundle, so this capability must // remain unavailable unless those assets are actually present. -func (a *App) GetFreshVMCapability() VMCapability { +func (a *App) vmRuntimeCapability() VMCapability { + if previewMode() { + return VMCapability{Reason: "VM execution is unavailable in the UI test harness."} + } + if err := prepareTrustedStateTree(wootcDir()); err != nil { + return VMCapability{Reason: err.Error()} + } + if err := verifyVMRuntime(qemuDir(), artifactPublicKey); err != nil { + return VMCapability{Reason: err.Error()} + } qemuPath, bundled := findQEMU() cap := VMCapability{QEMUPath: qemuPath, Bundled: bundled} if qemuPath == "" { @@ -140,12 +126,12 @@ func (a *App) GetFreshVMCapability() VMCapability { cap.Reason = "The VM firmware is missing. Reinstall wootc with the VM viewer." return cap } - if _, err := os.Stat(builderKernel()); err != nil { - cap.Reason = "The Try-in-VM builder image isn't bundled with this build." + if _, err := os.Stat(edk2VarsTemplate()); err != nil { + cap.Reason = "The persistent VM firmware template is missing." return cap } - if _, err := os.Stat(builderInitrd()); err != nil { - cap.Reason = "The VM builder initramfs is missing." + if _, _, err := vmResourceBudget(getSystemInfo().RAMGB); err != nil { + cap.Reason = err.Error() return cap } if acc := availableAccelerator(); acc != "" { @@ -157,126 +143,193 @@ func (a *App) GetFreshVMCapability() VMCapability { return cap } -// TryInVMFresh builds preview.raw from imageRef in a headless builder VM -// (stage 1), then launches an interactive preview window (stage 2). Progress -// events are emitted on "vm:progress" from the builder's IPC channel. +func (a *App) GetFreshVMCapability() VMCapability { + cap := a.vmRuntimeCapability() + if getSystemInfo().RAMGB < 6 { + cap.Available = false + cap.Reason = "This preparation profile needs at least 6 GB RAM so Windows retains memory. A lighter profile is not verified yet." + return cap + } + if !cap.Available { + return cap + } + if _, err := os.Stat(builderKernel()); err != nil { + cap.Available = false + cap.Reason = "The Try-in-VM builder image isn't bundled with this build." + return cap + } + if _, err := os.Stat(builderInitrd()); err != nil { + cap.Available = false + cap.Reason = "The VM builder initramfs is missing." + return cap + } + return cap +} + +// TryInVMFresh provisions one persistent raw disk, then launches its VM. +// Completion needs a matching helper receipt and actual disk identity. // Non-blocking: returns after the worker starts, before provisioning completes. func (a *App) TryInVMFresh(imageRef string) error { - if imageRef == "" { - return fmt.Errorf("no image selected") + if strings.TrimSpace(imageRef) == "" || strings.ContainsAny(imageRef, " \t\r\n") { + return fmt.Errorf("select a valid operating system image") } cap := a.GetFreshVMCapability() if !cap.Available { return fmt.Errorf("%s", cap.Reason) } - if err := os.MkdirAll(previewDir(), 0o755); err != nil { - return fmt.Errorf("create workspace: %w", err) + if err := prepareTrustedStateTree(wootcDir()); err != nil { + return err } - // A 20GB sparse raw disk — instant on NTFS (truncate does not allocate). - f, err := os.OpenFile(previewRaw(), os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o600) + release, err := acquireVMLock(managedVMRootDisk()) if err != nil { - return fmt.Errorf("create VM disk (an existing disk is preserved): %w", err) + return err } - if err := f.Truncate(20 << 30); err != nil { - f.Close() - return fmt.Errorf("size preview disk: %w", err) + if _, err := os.Lstat(managedVMRootDisk()); !os.IsNotExist(err) { + release() + return fmt.Errorf("an existing Linux disk is preserved; start that VM or explicitly remove it before preparing another") } - f.Close() - + if _, err := os.Lstat(vmStatePath(wootcDir())); !os.IsNotExist(err) { + release() + return fmt.Errorf("an existing VM installation record needs review before creating a new disk") + } + if err := os.MkdirAll(previewDir(), 0700); err != nil { + release() + return err + } + if err := os.MkdirAll(filepath.Dir(managedVMRootDisk()), 0700); err != nil { + release() + return err + } + ctx, cancel := context.WithTimeout(context.Background(), 2*time.Hour) + done := make(chan struct{}) + a.vmMu.Lock() + a.vmCancel = cancel + a.vmPrepareDone = done + a.vmMu.Unlock() go func() { - if err := a.runBuilderVM(imageRef, cap); err != nil { - a.emitVM(VMEvent{Stage: "error", Message: err.Error()}) - return + defer close(done) + defer cancel() + defer func() { a.vmMu.Lock(); a.vmCancel = nil; a.vmPrepareDone = nil; a.vmMu.Unlock() }() + state := VMState{SchemaVersion: 1, InstallID: newVMID(), RunID: newVMID(), Image: imageRef, DiskPath: managedVMRootDisk(), Phase: vmPreparing} + err := writeVMState(vmStatePath(wootcDir()), state) + if err == nil { + state.Image, err = resolveVMImage(ctx, imageRef) + } + if err == nil { + err = writeVMState(vmStatePath(wootcDir()), state) + } + if err == nil { + err = createVMImageFiles() + } + if err == nil { + err = a.runBuilderVM(ctx, cap, &state) + } + if err == nil { + state.Phase = vmReady + err = writeVMState(vmStatePath(wootcDir()), state) + } + if err == nil { + err = ctx.Err() + } + if err == nil { + err = a.launchManagedDesktop(cap, state, release) } - if err := a.launchInteractivePreview(cap); err != nil { + if err != nil { + if state.DiskID == "" { + state.Phase = vmFailed + } else { + // Preparation completed. Preserve its ready state if launch + // failed before QEMU touched the disk, or its recovery record + // if control setup failed after process creation. + if recorded, readErr := readVMState(vmStatePath(wootcDir())); readErr == nil { + state = recorded + } + if state.Phase == vmStarting { + state.Phase = vmRecovery + } + } + state.Error = err.Error() + _ = writeVMState(vmStatePath(wootcDir()), state) + release() a.emitVM(VMEvent{Stage: "error", Message: err.Error()}) return } - a.emitVM(VMEvent{Stage: "started", - Message: "The VM process started. Check its window; Linux desktop readiness is not yet verified."}) + a.emitVM(VMEvent{Stage: "started", Message: "Your persistent Linux VM is running. Desktop and account readiness are not yet verified."}) }() return nil } -// runBuilderVM launches the headless Alpine builder and blocks until it powers -// off (bootc install done) or fails. It serves an IPC socket the guest connects -// to for progress; the guest sends newline-delimited JSON {"step","pct"}. -func (a *App) runBuilderVM(imageRef string, cap VMCapability) error { - ln, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", previewIPCPort)) - if err != nil { - return fmt.Errorf("open IPC socket: %w", err) +func newVMID() string { + var id [16]byte + if _, err := rand.Read(id[:]); err != nil { + panic(err) } - defer ln.Close() + return hex.EncodeToString(id[:]) +} - a.emitVM(VMEvent{Stage: "pulling", Percent: 2, Message: "Starting builder…"}) +func resolveVMImage(ctx context.Context, image string) (string, error) { + host, repo, ref, err := registryRef(image) + if err != nil { + return "", err + } + puller := &ociPuller{client: &http.Client{Timeout: 60 * time.Second}, host: host, repo: repo} + if err = puller.authorize(ctx); err != nil { + return "", err + } + _, digest, err := puller.fetchManifest(ctx, ref) + if err != nil { + return "", err + } + return host + "/" + repo + "@" + digest, nil +} - args := []string{ - "-accel", cap.Accelerator, - "-display", "none", - "-m", "2G", "-smp", "2", - "-machine", "q35", - "-kernel", builderKernel(), - "-initrd", builderInitrd(), - "-append", "console=ttyS0 quiet wootc.image=" + imageRef, - "-drive", vmDiskDrive(previewRaw()), - "-chardev", fmt.Sprintf("socket,id=ipc,host=127.0.0.1,port=%d", previewIPCPort), - "-device", "virtio-serial", - "-device", "virtserialport,chardev=ipc,name=wootc.ipc", - "-serial", "null", - } - cmd := exec.Command(cap.QEMUPath, args...) +func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState) error { + logPath := filepath.Join(previewDir(), state.RunID+"-builder.log") + serialPath := filepath.Join(previewDir(), state.RunID+"-serial.log") + a.emitVM(VMEvent{Stage: "pulling", Message: "Preparing your persistent Linux system. Windows will remain available."}) + args := []string{"-accel", cap.Accelerator, "-display", "none", "-m", "3072", "-smp", "2", "-machine", "q35", "-cpu", "max", + "-kernel", builderKernel(), "-initrd", builderInitrd(), + "-append", "console=ttyS0 quiet wootc.image=" + state.Image + " wootc.run_id=" + state.RunID + " wootc.install_id=" + state.InstallID, + "-drive", vmDiskDrive(state.DiskPath) + ",serial=wootc-root", + "-drive", vmDiskDrive(filepath.Join(previewDir(), "scratch.disk")) + ",serial=wootc-scratch", + "-nic", "user", "-chardev", "file,id=ipc,path=" + qemuEscape(logPath), "-device", "virtio-serial", + "-device", "virtserialport,chardev=ipc,name=wootc.ipc", "-serial", "file:" + serialPath} + cmd := exec.CommandContext(ctx, cap.QEMUPath, args...) cmd.Dir = filepath.Dir(cap.QEMUPath) + cmd.Env = vmProcessEnvironment(cmd.Dir, previewDir()) cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true} - if err := cmd.Start(); err != nil { - return fmt.Errorf("launch builder VM: %w", err) + stderr, err := os.OpenFile(filepath.Join(previewDir(), state.RunID+"-builder-error.log"), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + return err } - - // Read guest progress until it disconnects; QEMU exits when the guest - // powers off after a clean bootc install. - done := make(chan struct{}) - var result builderResult - go func() { - defer close(done) - conn, err := acceptWithTimeout(ln, 90*time.Second) - if err != nil { - result.readErr = err - return - } - defer conn.Close() - result = readBuilderProgress(conn, a.emitVM) - }() - - waitErr := cmd.Wait() - <-done - if err := result.verify(waitErr); err != nil { + defer stderr.Close() + cmd.Stderr = stderr + if err = cmd.Start(); err != nil { return err } - if fi, err := os.Stat(previewRaw()); err != nil || fi.Size() == 0 { - return fmt.Errorf("builder produced no disk image") + job, err := ownVMProcess(cmd) + if err != nil { + _ = cmd.Process.Kill() + _ = cmd.Wait() + return err } - return nil -} - -// launchInteractivePreview opens the built preview.raw in a visible QEMU window. -func (a *App) launchInteractivePreview(cap VMCapability) error { - a.emitVM(VMEvent{Stage: "booting", Percent: 95, Message: "Starting the preview…"}) - args := []string{ - "-accel", cap.Accelerator, - "-m", "4G", "-smp", "4", - "-machine", "q35", - "-drive", vmDiskDrive(previewRaw()), - "-drive", "if=pflash,format=raw,readonly=on,file=" + edk2Code(), - "-nic", "user,hostfwd=tcp:127.0.0.1:2223-:22", - "-display", "gtk", - "-name", effectiveBranding().Name + " (VM)", - } - cmd := exec.Command(cap.QEMUPath, args...) - cmd.Dir = filepath.Dir(cap.QEMUPath) - cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: false} - if err := cmd.Start(); err != nil { - return fmt.Errorf("launch preview: %w", err) + defer job.Close() + if err = cmd.Wait(); err != nil { + return fmt.Errorf("VM preparation did not complete: %w", err) + } + if err = ctx.Err(); err != nil { + return err + } + log, err := os.Open(logPath) + if err != nil { + return err } - go func() { _ = cmd.Wait() }() + defer log.Close() + receipt, err := verifyVMBuilderReceipt(log, *state) + if err != nil { + return err + } + state.DiskID = receipt.DiskID return nil } @@ -286,14 +339,6 @@ func (a *App) InstallPreviewForReal(cfg InstallConfig) error { return fmt.Errorf("native promotion is not available yet: keep your VM disk; shutdown and boot compatibility checks are still required") } -// acceptWithTimeout accepts one connection or returns after d. -func acceptWithTimeout(ln net.Listener, d time.Duration) (net.Conn, error) { - if tl, ok := ln.(*net.TCPListener); ok { - _ = tl.SetDeadline(time.Now().Add(d)) - } - return ln.Accept() -} - func haxmAvailable() bool { out, err := runPowerShellOutput(`(Get-Service -Name intelhaxm -ErrorAction SilentlyContinue).Status`) return err == nil && strings.TrimSpace(out) == "Running" diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/native-tests.log b/docs/experiments/evidence/2026-09-26-managed-vm/native-tests.log new file mode 100644 index 00000000..efcdf875 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/native-tests.log @@ -0,0 +1,40 @@ +Verified SHA256 41673f179fc4e392b56bd759c8b983e6a7d1ff2f1c6f0daea465e5f056410695 +=== RUN TestVMOwnedJobReapsChildOnClose +--- PASS: TestVMOwnedJobReapsChildOnClose (0.05s) +=== RUN TestVMEnvironmentDoesNotInheritUserPluginPaths +--- PASS: TestVMEnvironmentDoesNotInheritUserPluginPaths (0.00s) +=== RUN TestVMReceiptRejectsProxySuccess +=== RUN TestVMReceiptRejectsProxySuccess/good +=== RUN TestVMReceiptRejectsProxySuccess/only-marker +=== RUN TestVMReceiptRejectsProxySuccess/wrong-run +=== RUN TestVMReceiptRejectsProxySuccess/wrong-image +=== RUN TestVMReceiptRejectsProxySuccess/wrong-disk +=== RUN TestVMReceiptRejectsProxySuccess/no-efi +=== RUN TestVMReceiptRejectsProxySuccess/duplicate +=== RUN TestVMReceiptRejectsProxySuccess/late-error +=== RUN TestVMReceiptRejectsProxySuccess/early-marker +--- PASS: TestVMReceiptRejectsProxySuccess (0.01s) + --- PASS: TestVMReceiptRejectsProxySuccess/good (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/only-marker (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-run (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-image (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-disk (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/no-efi (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/duplicate (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/late-error (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/early-marker (0.00s) +=== RUN TestVMDurableStateAndNativeWriterGuard +--- PASS: TestVMDurableStateAndNativeWriterGuard (0.04s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (0.84s) + --- PASS: TestManagedVMShutdownContract/clean (0.21s) + --- PASS: TestManagedVMShutdownContract/host (0.16s) + --- PASS: TestManagedVMShutdownContract/crash (0.16s) + --- PASS: TestManagedVMShutdownContract/hung (0.31s) +=== RUN TestVMRuntimeRequiresCompleteSignedClosure +--- PASS: TestVMRuntimeRequiresCompleteSignedClosure (0.05s) +PASS diff --git a/docs/managed-vm.md b/docs/managed-vm.md new file mode 100644 index 00000000..3b0cd34a --- /dev/null +++ b/docs/managed-vm.md @@ -0,0 +1,90 @@ +# Managed Windows VM lifecycle + +The VM uses one Linux system in `:\wootc\disks\root.disk`. +A restart reuses that image and `vm\firmware-vars.fd`. +It does not redeploy Linux. Native promotion needs more proof (ADR 0004). + +Standard releases still need a package and acquisition path for the runtime. +An executable alone is insufficient. The engine checks the complete runtime +against a signature before execution. An absent bundle makes the capability +unavailable. It does not cause a silent fallback to native install. + +## Runtime contract + +Stage QEMU for Windows 11.1.0 under `wootc\qemu`. +The tested installer supplies these files: + +| Path | Purpose | +|---|---| +| `qemu-system-x86_64.exe` | VM process, with all its DLLs and support files | +| `share/edk2-x86_64-code.fd` | Firmware code; 3,653,632 bytes | +| `share/edk2-i386-vars.fd` | Firmware template; 540,672 bytes; copy once per installation | +| `builder-vmlinuz`, `builder-initramfs.img` | Initial preparation helper | +| `SHA256SUMS`, `SHA256SUMS.sig` | Domain-bound manifest, signed by the key embedded in this installer | + +The manifest uses canonical relative paths, with no ambiguity about case. +Every runtime file must match the manifest. It rejects a DLL absent from the list. It also rejects links and changed files. Logs and writable firmware data stay outside this tree. +The installer checks permissions and reparse points before it loads the runtime. + +QEMU uses an absolute path and a protected directory. +Its environment has an explicit allowlist. It does not inherit user PATH, +GTK/GIO/QEMU module paths, or user configuration locations. + +WHPX must be enabled. The launcher selects `-cpu max`. +Each image still needs proof of CPU compatibility, especially with x86-64-v3. +A process does not prove acceleration, guest boot, or a usable desktop. + +## Preparation and ownership + +| Boundary | Required evidence or behavior | +|---|---| +| Target and scratch | Separate 40 GiB raw files; serials `wootc-root` and `wootc-scratch` | +| Helper memory | 3 GiB guest allocation; at least 6 GiB host RAM; lower-memory profiles need separate proof | +| Host capacity | At least 80 GiB free before file creation | +| Image | Immutable OCI digest; fresh installation and run IDs | +| Existing file | Never truncate or replace; preserve failed preparation for diagnosis | +| Helper completion | Exit zero, one structured receipt, then `STATUS=SUCCESS` | +| Receipt identity | Exact image/run/install IDs and the GPT GUID read from the target | +| Receipt validation | `filesystemVerified=true`, `efiVerified=true`, `accountOutcome=image-default` | +| Result transport | Private file-backed virtio channel owned by this QEMU launch; no public socket | + +The 80 GiB gate is a conservative trial limit, not a measured physical minimum. +The files are sparse. Product defaults still need a measurement of peak physical +space on Windows, a reserve, and an abort before space runs low. +A lighter image with a 2 GiB helper also needs proof for older PCs. +These are P0 requirements for the consumer path. + +This evidence proves the installed disk. It does not prove account setup or a +usable desktop. + +A mutex in Windows protects the image across engine processes. +An exclusive file handle also detects an unmanaged process that still has the +image open. Install, native boot, and uninstall use the same lock. +Native redeployment refuses a managed image until promotion can preserve it. +Uninstall locks each drive that it will clean. It keeps the disk and VM record +unless the user chooses to delete them. + +## Stop, restart and recovery + +QMP uses private inherited pipes. A job object in Windows owns the QEMU process. +If the engine exits, Windows stops that process. The engine writes state before +launch. An interruption leaves a record that needs recovery. +It never trusts a reused process ID. + +| Action or state | Contract | +|---|---| +| `StopVM` | Request ACPI shutdown; wait up to 90 seconds | +| Clean stop | Actual process exit and QMP `SHUTDOWN`, with `guest=true` and `reason=guest-shutdown` | +| Shutdown timeout | Guest keeps its writer lock; no clean-stop claim | +| `ForceStopVM` | Explicit force; mark the image as `needs_recovery` | +| Engine close | Request shutdown; force after the deadline; record recovery if unclean | +| Restart | Only from `ready` or `stopped`, with the same GPT identity | +| Stale active state | Recovery required; no automatic restart | +| `desktopReady` | Always false until independent guest evidence exists | + +The bounded wait allows the engine to exit. A forced stop never becomes a +clean stop. Follow-up work includes filesystem recovery, account/OOBE setup, +a desktop probe, and promotion of the same system to native boot. + +The shutdown evidence follows the [QEMU QMP reference](https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html#event-SHUTDOWN). +A guest request to power off does not prove that each application saved its documents. diff --git a/docs/winui-shell.md b/docs/winui-shell.md index 58283c8a..b473085b 100644 --- a/docs/winui-shell.md +++ b/docs/winui-shell.md @@ -224,6 +224,13 @@ Retain the legacy build until a native release passes its gates, before phase E | `GetLastRun` | — | `LifecycleState` | | `E2EDriveDirective` | — | `string` | | `E2EDriveReport` | `string` | `null` | +| `GetVMCapability` | — | `VMCapability` | Signed runtime and persistent disk availability. | +| `GetFreshVMCapability` | — | `VMCapability` | Signed runtime and helper availability. | +| `GetVMState` | — | `VMState` | Durable disk lifecycle; desktop readiness requires independent evidence. | +| `TryInVMFresh` | image string | — | Prepare one persistent system and launch its VM. | +| `BootInVM` | — | — | Restart the same verified, stopped VM disk. | +| `StopVM` | — | — | Request guest shutdown; preserve ownership until actual exit. | +| `ForceStopVM` | — | — | Explicit forced stop; disk requires recovery before reuse. | | `Shutdown` | — | `null` (engine exits 0) | Notifications use `install:progress` and `vm:progress`. diff --git a/shell/Wootc.Shell/Engine/Dto.cs b/shell/Wootc.Shell/Engine/Dto.cs index 7a5ae6a1..e2871a79 100644 --- a/shell/Wootc.Shell/Engine/Dto.cs +++ b/shell/Wootc.Shell/Engine/Dto.cs @@ -799,6 +799,46 @@ public class VMCapability public bool Bundled { get; set; } } +/// +/// VMState records the persistent installed system, not just a process. Ready +/// means provisioning verified the disk; DesktopReady needs separate guest proof. +/// +public class VMState +{ + [JsonPropertyName("schemaVersion")] + public int SchemaVersion { get; set; } + + [JsonPropertyName("installId")] + public string InstallId { get; set; } = string.Empty; + + [JsonPropertyName("runId")] + public string RunId { get; set; } = string.Empty; + + [JsonPropertyName("image")] + public string Image { get; set; } = string.Empty; + + [JsonPropertyName("diskId")] + public string DiskId { get; set; } = string.Empty; + + [JsonPropertyName("diskPath")] + public string DiskPath { get; set; } = string.Empty; + + [JsonPropertyName("phase")] + public string Phase { get; set; } = string.Empty; + + [JsonPropertyName("desktopReady")] + public bool DesktopReady { get; set; } + + [JsonPropertyName("pid")] + public int Pid { get; set; } + + [JsonPropertyName("error")] + public string? Error { get; set; } + + [JsonPropertyName("updatedAt")] + public string UpdatedAt { get; set; } = string.Empty; +} + /// /// BundleInfo describes a staged offline image bundle. Written by /// payload/bundle/make-bundle.sh as bundle.json. From 55d07261a4690466c4b64aa51f956959055f0599 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:24:36 +0000 Subject: [PATCH 04/33] Prepare the VM account through private fw_cfg input --- app/frontend/src/screens/launchpad.js | 10 +- app/frontend/src/screens/vmpreview.js | 10 +- app/frontend/wailsjs/go/main/App.js | 2 + app/serve.go | 10 ++ app/tools/gendto/main.go | 1 + app/vm_account.go | 86 +++++++++++++++++ app/vm_account_test.go | 92 +++++++++++++++++++ app/vm_builder_result.go | 7 +- app/vm_job_windows.go | 41 +++++++++ app/vm_job_windows_test.go | 1 + app/vm_lifecycle.go | 24 ++--- app/vm_managed_windows.go | 18 +++- app/vm_other.go | 4 + app/vm_windows.go | 44 +++++++-- .../native-account-tests.log | 48 ++++++++++ docs/managed-vm.md | 21 ++++- docs/winui-shell.md | 3 +- shell/Wootc.Shell/Engine/Dto.cs | 22 +++++ 18 files changed, 409 insertions(+), 35 deletions(-) create mode 100644 app/vm_account.go create mode 100644 app/vm_account_test.go create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/native-account-tests.log diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index ae9f6b6f..eef0ed48 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -352,13 +352,13 @@ export function renderLaunchpad() { // Footer const footer = el('div', 'footer'); - const installBtn = btn(`${installVerb()} →`, 'btn btn-primary', () => startInstall()); + const installBtn = btn('Advanced: install with reboot', 'btn btn-ghost', () => startInstall()); installBtn.id = 'install-btn'; footer.appendChild(btn('Cancel', 'btn btn-ghost', () => Quit())); - // Try-in-VM (§6.1): gated on fresh VM capability (deferred to post-1.0 per ADR 0001 / #231; - // available when builder artifacts are present in an offline bundle). + // VM-first is the normal path. Native installation remains an explicit action. if (state.freshVmCapability?.available && state.selected) { - footer.appendChild(btn('Try in VM', 'btn btn-ghost', () => tryInVM())); + const vmBtn = btn('Start Linux in a window', 'btn btn-primary', () => tryInVM()); + vmBtn.id = 'vm-prepare-btn'; footer.appendChild(vmBtn); } footer.appendChild(installBtn); // Defer validity to after mount so the hint element exists. @@ -396,6 +396,8 @@ function refreshInstallValidity() { const hint = document.getElementById('install-hint'); if (!btn) return; const c = state.config; + const vmBtn = document.getElementById('vm-prepare-btn'); + if (vmBtn) vmBtn.disabled = !state.selected || !/^[a-z_][a-z0-9_-]{0,31}$/.test(c.username) || c.username === 'root' || !c.password || c.password !== c.passwordConfirm; let reason = ''; // Preflight safety gates (#63) come FIRST: these are conditions under which // starting at all risks the user's data or leaves the machine half-converted. diff --git a/app/frontend/src/screens/vmpreview.js b/app/frontend/src/screens/vmpreview.js index 10a62217..f2701ac8 100644 --- a/app/frontend/src/screens/vmpreview.js +++ b/app/frontend/src/screens/vmpreview.js @@ -1,4 +1,4 @@ -import { TryInVMFresh, StopVM, ForceStopVM, BootInVM, GetUninstallInfo, GetVMState, GetVMCapability } from '../../wailsjs/go/main/App'; +import { PrepareVM, StopVM, ForceStopVM, BootInVM, GetUninstallInfo, GetVMState, GetVMCapability } from '../../wailsjs/go/main/App'; import { state } from '../lib/state.js'; import { render } from '../lib/render.js'; import { distroName } from '../lib/branding.js'; @@ -8,13 +8,15 @@ import { el, btn } from '../lib/ui.js'; export async function tryInVM() { if (!state.selected) return; + if (!state.config.password || state.config.password !== state.config.passwordConfirm) { alert('Set and confirm your Linux password first.'); return; } state.screen = 'vmpreview'; state.vmProgress = { stage: 'pulling', percent: 0, message: 'Preparing the builder…' }; state.vmReady = false; state.vmError = null; render(); try { - await TryInVMFresh(state.selected.imageRef); + await PrepareVM({ imageRef: state.selected.imageRef, username: state.config.username, password: state.config.password }); + state.config.password = ''; state.config.passwordConfirm = ''; } catch (e) { state.vmError = String(e); render(); @@ -36,8 +38,8 @@ export function renderVMPreviewScreen() { screen.appendChild(back); } else if (state.vmReady) { screen.innerHTML = `
🖥️
-

Your VM window has opened

-
${state.selected?.name || distroName()} has started in its own window. Check that Linux reaches its desktop. Native boot is not available from this preview yet; keep the disk to preserve your work.
`; +

Linux is starting

+
${state.selected?.name || distroName()} is starting in its own window. Sign in with your Linux username and password when the login screen appears. Your work stays on this disk. Native boot is not available yet.
`; const row = el('div'); row.style.cssText = 'display:flex;gap:10px;margin-top:8px'; row.appendChild(btn('Shut down Linux', 'btn btn-primary', async () => { try { await StopVM(); state.vmState = { phase: 'stopped' }; state.vmReady = false; render(); } diff --git a/app/frontend/wailsjs/go/main/App.js b/app/frontend/wailsjs/go/main/App.js index b049b618..7bf3313f 100644 --- a/app/frontend/wailsjs/go/main/App.js +++ b/app/frontend/wailsjs/go/main/App.js @@ -165,3 +165,5 @@ export function GetInstallSteps() { export function GetVMState() { return window['go']['main']['App']['GetVMState'](); } export function StopVM() { return window['go']['main']['App']['StopVM'](); } export function ForceStopVM() { return window['go']['main']['App']['ForceStopVM'](); } + +export function PrepareVM(config) { return window['go']['main']['App']['PrepareVM'](config); } diff --git a/app/serve.go b/app/serve.go index b0f37a4b..73917a0a 100644 --- a/app/serve.go +++ b/app/serve.go @@ -53,6 +53,7 @@ var ProtocolMethods = []string{ "GetFreshVMCapability", "GetVMState", "TryInVMFresh", + "PrepareVM", "BootInVM", "StopVM", "ForceStopVM", @@ -307,6 +308,15 @@ func (s *Server) dispatch(ctx context.Context, req jsonrpcRequest) (any, *jsonrp return s.app.GetFreshVMCapability(), nil case "GetVMState": return s.app.GetVMState(), nil + case "PrepareVM": + var cfg VMInstallConfig + if err := unmarshalParams(req.Params, &cfg); err != nil { + return nil, &jsonrpcError{Code: errCodeInvalidParams, Message: "invalid VM account parameters"} + } + if err := s.app.PrepareVM(cfg); err != nil { + return nil, &jsonrpcError{Code: errCodeInternal, Message: err.Error()} + } + return nil, nil case "TryInVMFresh": var image string if err := unmarshalStringParam(req.Params, &image); err != nil { diff --git a/app/tools/gendto/main.go b/app/tools/gendto/main.go index 3f08bdca..e570f454 100644 --- a/app/tools/gendto/main.go +++ b/app/tools/gendto/main.go @@ -35,6 +35,7 @@ var DTOStructs = []string{ "VMEvent", "VMCapability", "VMState", + "VMInstallConfig", "BundleInfo", } diff --git a/app/vm_account.go b/app/vm_account.go new file mode 100644 index 00000000..7e7f669c --- /dev/null +++ b/app/vm_account.go @@ -0,0 +1,86 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" + "path/filepath" + "regexp" + "strings" +) + +// VMInstallConfig contains only the choices implemented by the VM preparation +// path. Do not reuse native-install encryption/migration flags as implied promises. +type VMInstallConfig struct { + ImageRef string `json:"imageRef"` + Username string `json:"username"` + Password string `json:"password"` +} + +type vmAccountInput struct { + SchemaVersion int `json:"schemaVersion"` + RunID string `json:"runId"` + InstallID string `json:"installId"` + Username string `json:"username"` + PasswordHash string `json:"passwordHash"` +} + +var vmUsernamePattern = regexp.MustCompile(`^[a-z_][a-z0-9_-]{0,31}$`) + +func validateVMInstallConfig(cfg VMInstallConfig) error { + if cfg.ImageRef == "" || strings.ContainsAny(cfg.ImageRef, " \t\r\n\x00") { + return fmt.Errorf("select a valid operating system image") + } + if !vmUsernamePattern.MatchString(cfg.Username) || cfg.Username == "root" { + return fmt.Errorf("choose a Linux username of up to 32 lowercase letters, digits, underscores or hyphens, beginning with a letter or underscore; root is reserved") + } + if cfg.Password == "" || len(cfg.Password) > 1024 || strings.ContainsAny(cfg.Password, "\x00\r\n") { + return fmt.Errorf("enter a password without line breaks, up to 1024 bytes") + } + return nil +} + +// The caller holds the image lease and has verified the directory ACL. This +// file is never an argument value containing credentials: QEMU receives only +// its protected path, through fw_cfg. No secret enters durable lifecycle JSON. +func writeVMAccountInput(root string, input vmAccountInput) (string, error) { + if !regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9_-]{7,63}$`).MatchString(input.RunID) { + return "", fmt.Errorf("invalid preparation run identity") + } + data, err := json.Marshal(input) + if err != nil { + return "", err + } + path := filepath.Join(root, ".run-account-"+input.RunID+".json") + file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + return "", err + } + if _, err = file.Write(data); err == nil { + err = file.Sync() + } + closeErr := file.Close() + if err == nil { + err = closeErr + } + if err != nil { + os.Remove(path) + return "", fmt.Errorf("could not stage private account input") + } + return path, nil +} + +// Only call with the image lease: another live helper may still read its input. +// A crashed run keeps its disk and diagnostic state, but not its credential file. +func removeVMAccountInputs(root string) error { + matches, err := filepath.Glob(filepath.Join(root, ".run-account-*.json")) + if err != nil { + return err + } + for _, path := range matches { + if err := os.Remove(path); err != nil && !os.IsNotExist(err) { + return fmt.Errorf("could not remove private account input") + } + } + return nil +} diff --git a/app/vm_account_test.go b/app/vm_account_test.go new file mode 100644 index 00000000..ff952405 --- /dev/null +++ b/app/vm_account_test.go @@ -0,0 +1,92 @@ +package main + +import ( + "encoding/json" + "os" + "path/filepath" + "strings" + "testing" +) + +func TestVMAccountInputIsPrivateTransientAndPreservesDisk(t *testing.T) { + root := t.TempDir() + disk := filepath.Join(root, "root.disk") + if err := os.WriteFile(disk, []byte("existing Linux files"), 0600); err != nil { + t.Fatal(err) + } + input := vmAccountInput{SchemaVersion: 1, RunID: "run-12345", InstallID: "install-12345", Username: "alice", PasswordHash: "$6$test$hash"} + path, err := writeVMAccountInput(root, input) + if err != nil { + t.Fatal(err) + } + data, err := os.ReadFile(path) + if err != nil { + t.Fatal(err) + } + var got vmAccountInput + if err := json.Unmarshal(data, &got); err != nil { + t.Fatal(err) + } + if got != input { + t.Fatalf("private input changed: %+v", got) + } + if _, err := writeVMAccountInput(root, input); err == nil { + t.Fatal("existing account input overwritten") + } + if err := removeVMAccountInputs(root); err != nil { + t.Fatal(err) + } + if _, err := os.Stat(path); !os.IsNotExist(err) { + t.Fatal("stale account input survived cleanup") + } + data, err = os.ReadFile(disk) + if err != nil || string(data) != "existing Linux files" { + t.Fatal("credential cleanup damaged disk") + } +} +func TestVMAccountValidationDoesNotEchoPassword(t *testing.T) { + base := VMInstallConfig{ImageRef: "ghcr.io/test/os:latest", Username: "alice", Password: "private\nsecret"} + for _, which := range []string{"password", "root", "traversal", "image"} { + cfg := base + switch which { + case "root": + cfg.Username = "root" + case "traversal": + cfg.Username = "../alice" + case "image": + cfg.ImageRef = "image wootc.inject=yes" + } + err := validateVMInstallConfig(cfg) + if err == nil { + t.Errorf("accepted %s", which) + } else if strings.Contains(err.Error(), "private") { + t.Fatal("error leaked password") + } + } + base.Password = "a valid password" + if err := validateVMInstallConfig(base); err != nil { + t.Fatal(err) + } +} +func TestVMReceiptRequiresCreatedAccountIdentity(t *testing.T) { + path, id := vmTestDisk(t) + state := VMState{RunID: "run-12345", InstallID: "install-12345", Image: "image@digest", DiskPath: path, Username: "alice", AccountOutcome: "created"} + receipt := vmBuilderReceipt{Type: "result", SchemaVersion: 1, Status: "success", RunID: state.RunID, InstallID: state.InstallID, Image: state.Image, DiskID: id, FilesystemVerified: true, EFIVerified: true, AccountOutcome: "created", Username: "alice"} + check := func(receipt vmBuilderReceipt) error { + data, _ := json.Marshal(receipt) + _, err := verifyVMBuilderReceipt(strings.NewReader(string(data)+"\nSTATUS=SUCCESS\n"), state) + return err + } + if err := check(receipt); err != nil { + t.Fatal(err) + } + receipt.Username = "another" + if check(receipt) == nil { + t.Fatal("another account accepted") + } + receipt.Username = "alice" + receipt.AccountOutcome = "image-default" + if check(receipt) == nil { + t.Fatal("unpersonalized image accepted") + } +} diff --git a/app/vm_builder_result.go b/app/vm_builder_result.go index c83eeed4..57ecb347 100644 --- a/app/vm_builder_result.go +++ b/app/vm_builder_result.go @@ -19,6 +19,7 @@ type vmBuilderReceipt struct { FilesystemVerified bool `json:"filesystemVerified"` EFIVerified bool `json:"efiVerified"` AccountOutcome string `json:"accountOutcome"` + Username string `json:"username,omitempty"` } func verifyVMBuilderReceipt(input io.Reader, expected VMState) (vmBuilderReceipt, error) { @@ -66,7 +67,11 @@ func verifyVMBuilderReceipt(input io.Reader, expected VMState) (vmBuilderReceipt if receipt.SchemaVersion != 1 || receipt.Status != "success" || receipt.RunID != expected.RunID || receipt.InstallID != expected.InstallID || receipt.Image != expected.Image { return receipt, fmt.Errorf("builder result does not match this installation/run/image") } - if !receipt.FilesystemVerified || !receipt.EFIVerified || receipt.AccountOutcome != "image-default" { + accountOutcome := expected.AccountOutcome + if accountOutcome == "" { + accountOutcome = "image-default" + } + if !receipt.FilesystemVerified || !receipt.EFIVerified || receipt.AccountOutcome != accountOutcome || receipt.Username != expected.Username { return receipt, fmt.Errorf("builder did not verify the filesystem, EFI boot, and account outcome") } diskID, err := vmDiskIdentity(expected.DiskPath) diff --git a/app/vm_job_windows.go b/app/vm_job_windows.go index 9dcd4a1f..314dd4b7 100644 --- a/app/vm_job_windows.go +++ b/app/vm_job_windows.go @@ -3,9 +3,11 @@ package main import ( + "fmt" "golang.org/x/sys/windows" "io" "os/exec" + "syscall" "unsafe" ) @@ -33,5 +35,44 @@ func ownVMProcess(cmd *exec.Cmd) (io.Closer, error) { windows.CloseHandle(job) return nil, err } + if cmd.SysProcAttr != nil && cmd.SysProcAttr.CreationFlags&windows.CREATE_SUSPENDED != 0 { + if err := resumeVMPrimaryThread(uint32(cmd.Process.Pid)); err != nil { + windows.CloseHandle(job) + return nil, err + } + } return &vmJob{handle: job}, nil } + +// Suspend before the child can open a disk, assign ownership, then resume. +// A crash before assignment may leave an inert process, never an unowned writer. +func vmProcessAttributes() *syscall.SysProcAttr { + return &syscall.SysProcAttr{HideWindow: true, CreationFlags: windows.CREATE_SUSPENDED} +} +func resumeVMPrimaryThread(pid uint32) error { + snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPTHREAD, 0) + if err != nil { + return err + } + defer windows.CloseHandle(snapshot) + entry := windows.ThreadEntry32{Size: uint32(unsafe.Sizeof(windows.ThreadEntry32{}))} + for err = windows.Thread32First(snapshot, &entry); err == nil; err = windows.Thread32Next(snapshot, &entry) { + if entry.OwnerProcessID != pid { + continue + } + thread, err := windows.OpenThread(windows.THREAD_SUSPEND_RESUME, false, entry.ThreadID) + if err != nil { + return err + } + previous, err := windows.ResumeThread(thread) + windows.CloseHandle(thread) + if err != nil { + return err + } + if previous != 1 { + return fmt.Errorf("unexpected VM thread suspension count: %d", previous) + } + return nil + } + return fmt.Errorf("could not find suspended VM primary thread: %w", err) +} diff --git a/app/vm_job_windows_test.go b/app/vm_job_windows_test.go index a0ed3772..0d24503f 100644 --- a/app/vm_job_windows_test.go +++ b/app/vm_job_windows_test.go @@ -20,6 +20,7 @@ func TestVMOwnedJobReapsChildOnClose(t *testing.T) { } cmd := exec.Command(os.Args[0], "-test.run=^TestVMOwnedJobReapsChildOnClose$") cmd.Env = append(os.Environ(), "WOOTC_TEST_JOB_CHILD=1") + cmd.SysProcAttr = vmProcessAttributes() output, err := cmd.StdoutPipe() if err != nil { t.Fatal(err) diff --git a/app/vm_lifecycle.go b/app/vm_lifecycle.go index 31ea04c1..bc1d3bc9 100644 --- a/app/vm_lifecycle.go +++ b/app/vm_lifecycle.go @@ -25,17 +25,19 @@ const ( // VMState records the persistent installed system, not just a process. Ready // means provisioning verified the disk; DesktopReady needs separate guest proof. type VMState struct { - SchemaVersion int `json:"schemaVersion"` - InstallID string `json:"installId"` - RunID string `json:"runId"` - Image string `json:"image"` - DiskID string `json:"diskId"` - DiskPath string `json:"diskPath"` - Phase string `json:"phase"` - DesktopReady bool `json:"desktopReady"` - PID int `json:"pid"` - Error string `json:"error,omitempty"` - UpdatedAt string `json:"updatedAt"` + SchemaVersion int `json:"schemaVersion"` + InstallID string `json:"installId"` + RunID string `json:"runId"` + Image string `json:"image"` + Username string `json:"username,omitempty"` + AccountOutcome string `json:"accountOutcome,omitempty"` + DiskID string `json:"diskId"` + DiskPath string `json:"diskPath"` + Phase string `json:"phase"` + DesktopReady bool `json:"desktopReady"` + PID int `json:"pid"` + Error string `json:"error,omitempty"` + UpdatedAt string `json:"updatedAt"` } func readVMState(path string) (VMState, error) { diff --git a/app/vm_managed_windows.go b/app/vm_managed_windows.go index 0cbbb8c5..9f44c05f 100644 --- a/app/vm_managed_windows.go +++ b/app/vm_managed_windows.go @@ -8,16 +8,30 @@ import ( "os" "os/exec" "path/filepath" - "syscall" "time" ) func (a *App) GetVMState() VMState { + if previewMode() { + return VMState{SchemaVersion: 1, Phase: "unavailable", Error: "VM execution is unavailable in the UI test harness."} + } a.vmMu.Lock() defer a.vmMu.Unlock() if a.vmSession != nil { return a.vmSession.snapshot() } + if a.vmCancel == nil { + if err := prepareTrustedStateTree(wootcDir()); err != nil { + return VMState{SchemaVersion: 1, Phase: vmRecovery, Error: err.Error()} + } + if release, err := acquireVMLock(managedVMRootDisk()); err == nil { + cleanupErr := removeVMAccountInputs(previewDir()) + release() + if cleanupErr != nil { + return VMState{SchemaVersion: 1, Phase: vmRecovery, Error: cleanupErr.Error()} + } + } + } state, err := readVMState(vmStatePath(wootcDir())) if os.IsNotExist(err) { return VMState{SchemaVersion: 1, Phase: "absent"} @@ -158,7 +172,7 @@ func (a *App) launchManagedDesktop(cap VMCapability, state VMState, release func cmd := exec.Command(cap.QEMUPath, args...) cmd.Dir = filepath.Dir(cap.QEMUPath) cmd.Env = vmProcessEnvironment(cmd.Dir, previewDir()) - cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true} + cmd.SysProcAttr = vmProcessAttributes() log, err := os.OpenFile(filepath.Join(wootcDir(), "vm", "qemu.log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) if err != nil { return err diff --git a/app/vm_other.go b/app/vm_other.go index a8544f8c..002f759c 100644 --- a/app/vm_other.go +++ b/app/vm_other.go @@ -41,3 +41,7 @@ func (a *App) GetVMState() VMState { func (a *App) StopVM() error { return fmt.Errorf("managed VMs are only available on Windows") } func (a *App) ForceStopVM() error { return fmt.Errorf("managed VMs are only available on Windows") } func (a *App) shutdownVM() {} + +func (a *App) PrepareVM(cfg VMInstallConfig) error { + return fmt.Errorf("managed VMs are only available on Windows") +} diff --git a/app/vm_windows.go b/app/vm_windows.go index 96f46c04..df4a62de 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -12,7 +12,6 @@ import ( "os/exec" "path/filepath" "strings" - "syscall" "time" ) @@ -78,6 +77,10 @@ func (a *App) BootInVM() error { if err != nil { return err } + if err := removeVMAccountInputs(previewDir()); err != nil { + release() + return err + } state, err := readVMState(vmStatePath(wootcDir())) if err == nil { err = a.launchManagedDesktop(cap, state, release) @@ -170,9 +173,19 @@ func (a *App) GetFreshVMCapability() VMCapability { // Completion needs a matching helper receipt and actual disk identity. // Non-blocking: returns after the worker starts, before provisioning completes. func (a *App) TryInVMFresh(imageRef string) error { - if strings.TrimSpace(imageRef) == "" || strings.ContainsAny(imageRef, " \t\r\n") { - return fmt.Errorf("select a valid operating system image") + return fmt.Errorf("Linux account details are required; use PrepareVM") +} + +func (a *App) PrepareVM(cfg VMInstallConfig) error { + if err := validateVMInstallConfig(cfg); err != nil { + return err + } + hash, err := hashPassword(cfg.Password) + cfg.Password = "" + if err != nil { + return fmt.Errorf("could not prepare the Linux password") } + imageRef := cfg.ImageRef cap := a.GetFreshVMCapability() if !cap.Available { return fmt.Errorf("%s", cap.Reason) @@ -184,6 +197,10 @@ func (a *App) TryInVMFresh(imageRef string) error { if err != nil { return err } + if err := removeVMAccountInputs(previewDir()); err != nil { + release() + return err + } if _, err := os.Lstat(managedVMRootDisk()); !os.IsNotExist(err) { release() return fmt.Errorf("an existing Linux disk is preserved; start that VM or explicitly remove it before preparing another") @@ -210,7 +227,7 @@ func (a *App) TryInVMFresh(imageRef string) error { defer close(done) defer cancel() defer func() { a.vmMu.Lock(); a.vmCancel = nil; a.vmPrepareDone = nil; a.vmMu.Unlock() }() - state := VMState{SchemaVersion: 1, InstallID: newVMID(), RunID: newVMID(), Image: imageRef, DiskPath: managedVMRootDisk(), Phase: vmPreparing} + state := VMState{SchemaVersion: 1, InstallID: newVMID(), RunID: newVMID(), Image: imageRef, DiskPath: managedVMRootDisk(), Phase: vmPreparing, Username: cfg.Username, AccountOutcome: "created"} err := writeVMState(vmStatePath(wootcDir()), state) if err == nil { state.Image, err = resolveVMImage(ctx, imageRef) @@ -222,7 +239,8 @@ func (a *App) TryInVMFresh(imageRef string) error { err = createVMImageFiles() } if err == nil { - err = a.runBuilderVM(ctx, cap, &state) + err = a.runBuilderVM(ctx, cap, &state, hash) + hash = "" } if err == nil { state.Phase = vmReady @@ -283,13 +301,23 @@ func resolveVMImage(ctx context.Context, image string) (string, error) { return host + "/" + repo + "@" + digest, nil } -func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState) error { +func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState, passwordHash string) (resultErr error) { + accountPath, err := writeVMAccountInput(previewDir(), vmAccountInput{SchemaVersion: 1, RunID: state.RunID, InstallID: state.InstallID, Username: state.Username, PasswordHash: passwordHash}) + if err != nil { + return err + } + defer func() { + if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) && resultErr == nil { + resultErr = fmt.Errorf("could not remove private account input") + } + }() logPath := filepath.Join(previewDir(), state.RunID+"-builder.log") serialPath := filepath.Join(previewDir(), state.RunID+"-serial.log") a.emitVM(VMEvent{Stage: "pulling", Message: "Preparing your persistent Linux system. Windows will remain available."}) args := []string{"-accel", cap.Accelerator, "-display", "none", "-m", "3072", "-smp", "2", "-machine", "q35", "-cpu", "max", "-kernel", builderKernel(), "-initrd", builderInitrd(), - "-append", "console=ttyS0 quiet wootc.image=" + state.Image + " wootc.run_id=" + state.RunID + " wootc.install_id=" + state.InstallID, + "-append", "console=ttyS0 quiet wootc.image=" + state.Image + " wootc.run_id=" + state.RunID + " wootc.install_id=" + state.InstallID + " wootc.account_mode=create", + "-fw_cfg", "name=opt/wootc/install,file=" + qemuEscape(accountPath), "-drive", vmDiskDrive(state.DiskPath) + ",serial=wootc-root", "-drive", vmDiskDrive(filepath.Join(previewDir(), "scratch.disk")) + ",serial=wootc-scratch", "-nic", "user", "-chardev", "file,id=ipc,path=" + qemuEscape(logPath), "-device", "virtio-serial", @@ -297,7 +325,7 @@ func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState cmd := exec.CommandContext(ctx, cap.QEMUPath, args...) cmd.Dir = filepath.Dir(cap.QEMUPath) cmd.Env = vmProcessEnvironment(cmd.Dir, previewDir()) - cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true} + cmd.SysProcAttr = vmProcessAttributes() stderr, err := os.OpenFile(filepath.Join(previewDir(), state.RunID+"-builder-error.log"), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) if err != nil { return err diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/native-account-tests.log b/docs/experiments/evidence/2026-09-26-managed-vm/native-account-tests.log new file mode 100644 index 00000000..dac80033 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/native-account-tests.log @@ -0,0 +1,48 @@ +Verified SHA256 348b79fba4c8dbdd58a671311d004c96c55063a39bc8e44f7e47841289c35ff5 +=== RUN TestVMAccountInputIsPrivateTransientAndPreservesDisk +--- PASS: TestVMAccountInputIsPrivateTransientAndPreservesDisk (0.03s) +=== RUN TestVMAccountValidationDoesNotEchoPassword +--- PASS: TestVMAccountValidationDoesNotEchoPassword (0.00s) +=== RUN TestVMReceiptRequiresCreatedAccountIdentity +--- PASS: TestVMReceiptRequiresCreatedAccountIdentity (0.01s) +=== RUN TestVMOwnedJobReapsChildOnClose +--- PASS: TestVMOwnedJobReapsChildOnClose (0.17s) +=== RUN TestVMEnvironmentDoesNotInheritUserPluginPaths +--- PASS: TestVMEnvironmentDoesNotInheritUserPluginPaths (0.00s) +=== RUN TestVMReceiptRejectsProxySuccess +=== RUN TestVMReceiptRejectsProxySuccess/good +=== RUN TestVMReceiptRejectsProxySuccess/only-marker +=== RUN TestVMReceiptRejectsProxySuccess/wrong-run +=== RUN TestVMReceiptRejectsProxySuccess/wrong-image +=== RUN TestVMReceiptRejectsProxySuccess/wrong-disk +=== RUN TestVMReceiptRejectsProxySuccess/no-efi +=== RUN TestVMReceiptRejectsProxySuccess/duplicate +=== RUN TestVMReceiptRejectsProxySuccess/late-error +=== RUN TestVMReceiptRejectsProxySuccess/early-marker +--- PASS: TestVMReceiptRejectsProxySuccess (0.01s) + --- PASS: TestVMReceiptRejectsProxySuccess/good (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/only-marker (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-run (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-image (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-disk (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/no-efi (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/duplicate (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/late-error (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/early-marker (0.00s) +=== RUN TestVMDurableStateAndNativeWriterGuard +--- PASS: TestVMDurableStateAndNativeWriterGuard (0.04s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (0.66s) + --- PASS: TestManagedVMShutdownContract/clean (0.12s) + --- PASS: TestManagedVMShutdownContract/host (0.12s) + --- PASS: TestManagedVMShutdownContract/crash (0.12s) + --- PASS: TestManagedVMShutdownContract/hung (0.29s) +=== RUN TestQMPRejectsMissingGreetingPromptly +--- PASS: TestQMPRejectsMissingGreetingPromptly (0.00s) +=== RUN TestVMRuntimeRequiresCompleteSignedClosure +--- PASS: TestVMRuntimeRequiresCompleteSignedClosure (0.05s) +PASS diff --git a/docs/managed-vm.md b/docs/managed-vm.md index 3b0cd34a..3f78d497 100644 --- a/docs/managed-vm.md +++ b/docs/managed-vm.md @@ -45,7 +45,7 @@ A process does not prove acceleration, guest boot, or a usable desktop. | Existing file | Never truncate or replace; preserve failed preparation for diagnosis | | Helper completion | Exit zero, one structured receipt, then `STATUS=SUCCESS` | | Receipt identity | Exact image/run/install IDs and the GPT GUID read from the target | -| Receipt validation | `filesystemVerified=true`, `efiVerified=true`, `accountOutcome=image-default` | +| Receipt validation | `filesystemVerified=true`, `efiVerified=true`, `accountOutcome=created` and exact username | | Result transport | Private file-backed virtio channel owned by this QEMU launch; no public socket | The 80 GiB gate is a conservative trial limit, not a measured physical minimum. @@ -54,8 +54,18 @@ space on Windows, a reserve, and an abort before space runs low. A lighter image with a 2 GiB helper also needs proof for older PCs. These are P0 requirements for the consumer path. -This evidence proves the installed disk. It does not prove account setup or a -usable desktop. +The host sends account input through private `fw_cfg` data. +The file contains a password hash, never a plaintext password. +It stays under the protected VM directory, outside logs and durable state. +The host removes it after the helper exits. After a crash, cleanup first takes +the image lock. It removes only account input, not the Linux disk. + +The GUI reuses the Linux username and password fields. It derives the username +from Windows when possible. `PrepareVM` accepts these choices. Without an account, +`TryInVMFresh` refuses preparation. + +This evidence proves the installed disk and the helper's account result. +A usable login and desktop still need independent guest evidence. A mutex in Windows protects the image across engine processes. An exclusive file handle also detects an unmanaged process that still has the @@ -67,6 +77,9 @@ unless the user chooses to delete them. ## Stop, restart and recovery QMP uses private inherited pipes. A job object in Windows owns the QEMU process. +The host creates QEMU suspended, assigns the job, then resumes it. +A crash before assignment can leave an inert process, but no unowned writer. + If the engine exits, Windows stops that process. The engine writes state before launch. An interruption leaves a record that needs recovery. It never trusts a reused process ID. @@ -83,7 +96,7 @@ It never trusts a reused process ID. | `desktopReady` | Always false until independent guest evidence exists | The bounded wait allows the engine to exit. A forced stop never becomes a -clean stop. Follow-up work includes filesystem recovery, account/OOBE setup, +clean stop. Follow-up work includes filesystem recovery, account/login proof, a desktop probe, and promotion of the same system to native boot. The shutdown evidence follows the [QEMU QMP reference](https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html#event-SHUTDOWN). diff --git a/docs/winui-shell.md b/docs/winui-shell.md index b473085b..6cdd7cef 100644 --- a/docs/winui-shell.md +++ b/docs/winui-shell.md @@ -227,7 +227,8 @@ Retain the legacy build until a native release passes its gates, before phase E | `GetVMCapability` | — | `VMCapability` | Signed runtime and persistent disk availability. | | `GetFreshVMCapability` | — | `VMCapability` | Signed runtime and helper availability. | | `GetVMState` | — | `VMState` | Durable disk lifecycle; desktop readiness requires independent evidence. | -| `TryInVMFresh` | image string | — | Prepare one persistent system and launch its VM. | +| `TryInVMFresh` | image string | — | Legacy call refuses preparation without account details. | +| `PrepareVM` | `VMInstallConfig` | — | Prepare a persistent system with its Linux account, then launch its VM. | | `BootInVM` | — | — | Restart the same verified, stopped VM disk. | | `StopVM` | — | — | Request guest shutdown; preserve ownership until actual exit. | | `ForceStopVM` | — | — | Explicit forced stop; disk requires recovery before reuse. | diff --git a/shell/Wootc.Shell/Engine/Dto.cs b/shell/Wootc.Shell/Engine/Dto.cs index e2871a79..aa4b7d89 100644 --- a/shell/Wootc.Shell/Engine/Dto.cs +++ b/shell/Wootc.Shell/Engine/Dto.cs @@ -817,6 +817,12 @@ public class VMState [JsonPropertyName("image")] public string Image { get; set; } = string.Empty; + [JsonPropertyName("username")] + public string? Username { get; set; } + + [JsonPropertyName("accountOutcome")] + public string? AccountOutcome { get; set; } + [JsonPropertyName("diskId")] public string DiskId { get; set; } = string.Empty; @@ -839,6 +845,22 @@ public class VMState public string UpdatedAt { get; set; } = string.Empty; } +/// +/// VMInstallConfig contains only the choices implemented by the VM preparation +/// path. Do not reuse native-install encryption/migration flags as implied promises. +/// +public class VMInstallConfig +{ + [JsonPropertyName("imageRef")] + public string ImageRef { get; set; } = string.Empty; + + [JsonPropertyName("username")] + public string Username { get; set; } = string.Empty; + + [JsonPropertyName("password")] + public string Password { get; set; } = string.Empty; +} + /// /// BundleInfo describes a staged offline image bundle. Written by /// payload/bundle/make-bundle.sh as bundle.json. From 59c35e1d020b6828d8bc73a96ee3f96e04428c00 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:25:12 +0000 Subject: [PATCH 05/33] State which account choices apply to VM preparation --- app/frontend/src/screens/launchpad.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index eef0ed48..d48eb89e 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -443,6 +443,10 @@ function refreshPlanNote() { const note = document.getElementById('plan-note'); if (!note) return; const c = state.config; + if (state.freshVmCapability?.available) { + note.textContent = `Linux starts in a window with the account “${c.username || 'your username'}”. Your Windows files stay where they are. The disk, encryption, appearance and computer-name options under Advanced apply only to installation with a reboot.`; + return; + } const disk = state.sysinfo?.bitLockerOn ? `${c.diskSizeGB} GB set aside for Linux` : `${c.diskSizeGB} GB for Linux (space is only used as you fill it)`; From d560680b931150653fff58d03f2a73b9140f5e45 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:37:24 +0000 Subject: [PATCH 06/33] Require observable guest execution before offering the Windows VM --- app/app.go | 4 ++ app/frontend/src/screens/control.js | 2 +- app/frontend/src/screens/launchpad.js | 4 +- app/frontend/src/screens/vmpreview.js | 2 +- app/serve_test.go | 7 +- app/testdata/dto/vm_capability.json | 9 +-- app/vm_managed_windows.go | 2 +- app/vm_other.go | 1 + app/vm_probe.go | 70 ++++++++++++++++++ app/vm_probe_test.go | 72 +++++++++++++++++++ app/vm_probe_windows.go | 72 +++++++++++++++++++ app/vm_probe_windows_test.go | 42 +++++++++++ app/vm_runtime.go | 16 ++++- app/vm_runtime_test.go | 16 ++++- app/vm_windows.go | 13 ++-- app/vmprobe/serial-boot.S | 35 +++++++++ .../native-probe-tests.log | 67 +++++++++++++++++ docs/managed-vm.md | 29 ++++++++ shell/Wootc.Shell/Engine/Dto.cs | 3 + tests/gui/gui.spec.js | 24 +++++++ tests/gui/mock-backend.js | 9 ++- 21 files changed, 478 insertions(+), 21 deletions(-) create mode 100644 app/vm_probe.go create mode 100644 app/vm_probe_test.go create mode 100644 app/vm_probe_windows.go create mode 100644 app/vm_probe_windows_test.go create mode 100644 app/vmprobe/serial-boot.S create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/native-probe-tests.log diff --git a/app/app.go b/app/app.go index 794df553..fadc5cbf 100644 --- a/app/app.go +++ b/app/app.go @@ -229,6 +229,10 @@ type App struct { vmSession *vmSession vmCancel context.CancelFunc vmPrepareDone chan struct{} + vmProbeMu sync.Mutex + vmProbeKey string + vmProbeResult vmExecutionProbeResult + vmProbeAt time.Time } func NewApp() *App { diff --git a/app/frontend/src/screens/control.js b/app/frontend/src/screens/control.js index 5bb6a39c..354e7a3d 100644 --- a/app/frontend/src/screens/control.js +++ b/app/frontend/src/screens/control.js @@ -119,7 +119,7 @@ export function renderControlPanel() {
Try Linux in a window
${vm.available - ? `Boot your installed ${distroName()} in a window using ${String(vm.accelerator || 'hardware acceleration').toUpperCase()}. Changes persist — it's the same system.` + ? `Boot your installed ${distroName()} in a window using ${String(vm.accelerator || 'hardware acceleration').split(',')[0].toUpperCase()}. Changes persist — it's the same system.` : vm.reason}
`; const vmBtn = btn('Boot in VM', 'btn btn-ghost', async () => { diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index d48eb89e..be530b6d 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -352,12 +352,12 @@ export function renderLaunchpad() { // Footer const footer = el('div', 'footer'); - const installBtn = btn('Advanced: install with reboot', 'btn btn-ghost', () => startInstall()); + const installBtn = btn(`Advanced: ${installVerb()} with reboot`, 'btn btn-ghost', () => startInstall()); installBtn.id = 'install-btn'; footer.appendChild(btn('Cancel', 'btn btn-ghost', () => Quit())); // VM-first is the normal path. Native installation remains an explicit action. if (state.freshVmCapability?.available && state.selected) { - const vmBtn = btn('Start Linux in a window', 'btn btn-primary', () => tryInVM()); + const vmBtn = btn(`Start ${distroName()} in a window`, 'btn btn-primary', () => tryInVM()); vmBtn.id = 'vm-prepare-btn'; footer.appendChild(vmBtn); } footer.appendChild(installBtn); diff --git a/app/frontend/src/screens/vmpreview.js b/app/frontend/src/screens/vmpreview.js index f2701ac8..b87d3d3e 100644 --- a/app/frontend/src/screens/vmpreview.js +++ b/app/frontend/src/screens/vmpreview.js @@ -39,7 +39,7 @@ export function renderVMPreviewScreen() { } else if (state.vmReady) { screen.innerHTML = `
🖥️

Linux is starting

-
${state.selected?.name || distroName()} is starting in its own window. Sign in with your Linux username and password when the login screen appears. Your work stays on this disk. Native boot is not available yet.
`; +
${state.selected?.name || distroName()} is starting in its own window. Sign in with your Linux username and password when the login screen appears. Your work stays on this disk. To close Linux safely, use Shut down Linux below. Native boot is not available yet.
`; const row = el('div'); row.style.cssText = 'display:flex;gap:10px;margin-top:8px'; row.appendChild(btn('Shut down Linux', 'btn btn-primary', async () => { try { await StopVM(); state.vmState = { phase: 'stopped' }; state.vmReady = false; render(); } diff --git a/app/serve_test.go b/app/serve_test.go index 97699f2b..52237ecd 100644 --- a/app/serve_test.go +++ b/app/serve_test.go @@ -176,10 +176,11 @@ func sampleDTOs() map[string]any { "vm_capability": VMCapability{ Available: true, Reason: "", - DiskPath: `C:\wootc\preview.vhdx`, - Accelerator: "hyperv", - QEMUPath: `C:\Program Files\qemu\qemu-system-x86_64.exe`, + DiskPath: `C:\wootc\disks\root.disk`, + Accelerator: "whpx,kernel-irqchip=off", + QEMUPath: `C:\wootc\qemu\qemu-system-x86_64.exe`, Bundled: true, + ProbeStatus: "passed", }, "bundle_info": BundleInfo{ Image: "ghcr.io/tuna-os/yellowfin:gnome", diff --git a/app/testdata/dto/vm_capability.json b/app/testdata/dto/vm_capability.json index 0d680f86..3e33ac6d 100644 --- a/app/testdata/dto/vm_capability.json +++ b/app/testdata/dto/vm_capability.json @@ -1,8 +1,9 @@ { "available": true, "reason": "", - "diskPath": "C:\\wootc\\preview.vhdx", - "accelerator": "hyperv", - "qemuPath": "C:\\Program Files\\qemu\\qemu-system-x86_64.exe", - "bundled": true + "diskPath": "C:\\wootc\\disks\\root.disk", + "accelerator": "whpx,kernel-irqchip=off", + "qemuPath": "C:\\wootc\\qemu\\qemu-system-x86_64.exe", + "bundled": true, + "probeStatus": "passed" } diff --git a/app/vm_managed_windows.go b/app/vm_managed_windows.go index 9f44c05f..6673e1aa 100644 --- a/app/vm_managed_windows.go +++ b/app/vm_managed_windows.go @@ -167,7 +167,7 @@ func (a *App) launchManagedDesktop(cap VMCapability, state VMState, release func "-drive", vmDiskDrive(state.DiskPath), "-drive", "if=pflash,format=raw,readonly=on,file=" + qemuEscape(edk2Code()), "-drive", "if=pflash,format=raw,file=" + qemuEscape(managedVMVars()), - "-nic", "user", "-display", "gtk", "-qmp", "stdio", "-monitor", "none", + "-nic", "user", "-display", "gtk,window-close=off,show-menubar=off", "-qmp", "stdio", "-monitor", "none", "-name", effectiveBranding().Name + " (VM)"} cmd := exec.Command(cap.QEMUPath, args...) cmd.Dir = filepath.Dir(cap.QEMUPath) diff --git a/app/vm_other.go b/app/vm_other.go index 002f759c..350b2615 100644 --- a/app/vm_other.go +++ b/app/vm_other.go @@ -13,6 +13,7 @@ type VMCapability struct { Accelerator string `json:"accelerator"` QEMUPath string `json:"qemuPath"` Bundled bool `json:"bundled"` + ProbeStatus string `json:"probeStatus"` } func (a *App) GetVMCapability() VMCapability { diff --git a/app/vm_probe.go b/app/vm_probe.go new file mode 100644 index 00000000..74f4d6b8 --- /dev/null +++ b/app/vm_probe.go @@ -0,0 +1,70 @@ +package main + +import ( + "context" + _ "embed" + "fmt" + "io" + "os" + "os/exec" + "strings" + "time" +) + +//go:embed vmprobe/serial-boot.img +var vmProbeBootSector []byte + +const vmProbeMarker = "WOOTC_WHPX_BOOTSECTOR_EXECUTED" + +type vmExecutionProbeResult struct { + Status string + Detail string + Accelerator string +} + +// Read guest serial from a newly created file, never process liveness or an +// old diagnostic log. The image is a read-only 512-byte program with no OS or +// user data. Terminating this probe cannot interrupt a writable filesystem. +func runVMExecutionProbe(ctx context.Context, cmd *exec.Cmd, serialPath string, own func(*exec.Cmd) (io.Closer, error)) vmExecutionProbeResult { + result := vmExecutionProbeResult{Status: "failed"} + serial, err := os.OpenFile(serialPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + result.Detail = "Could not create a private VM execution probe." + return result + } + serial.Close() + if err = cmd.Start(); err != nil { + result.Detail = fmt.Sprintf("Could not start the VM execution probe: %v", err) + return result + } + job, err := own(cmd) + if err != nil { + cmd.Process.Kill() + cmd.Wait() + result.Detail = "Could not own the VM execution probe." + return result + } + done := make(chan error, 1) + go func() { done <- cmd.Wait() }() + defer func() { _ = cmd.Process.Kill(); _ = job.Close(); <-done }() + ticker := time.NewTicker(100 * time.Millisecond) + defer ticker.Stop() + for { + select { + case <-ctx.Done(): + result.Status = "timed_out" + result.Detail = "The guest execution check did not finish within its time limit. A slow or busy PC can cause this; it does not prove this PC is unsupported. Close other apps and try again." + return result + case err := <-done: + done <- err // leave the single completion for the cleanup barrier + result.Detail = "The VM execution probe exited before guest code reported success." + return result + case <-ticker.C: + data, err := readLocalMetadata(serialPath, 8192) + if err == nil && strings.Contains(string(data), vmProbeMarker) { + result.Status = "passed" + return result + } + } + } +} diff --git a/app/vm_probe_test.go b/app/vm_probe_test.go new file mode 100644 index 00000000..824b0eb1 --- /dev/null +++ b/app/vm_probe_test.go @@ -0,0 +1,72 @@ +package main + +import ( + "bytes" + "context" + "crypto/sha256" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func TestVMExecutionProbeChild(t *testing.T) { + mode := os.Getenv("WOOTC_TEST_PROBE_CHILD") + if mode == "" { + return + } + switch mode { + case "guest": + _ = os.WriteFile(os.Getenv("WOOTC_TEST_PROBE_SERIAL"), []byte(vmProbeMarker), 0600) + case "stdout": + fmt.Println(vmProbeMarker) + case "exit": + os.Exit(0) + } + time.Sleep(time.Minute) + os.Exit(0) +} +func TestVMExecutionProbeNeedsActualSerial(t *testing.T) { + for _, mode := range []string{"guest", "stdout", "hung", "exit"} { + t.Run(mode, func(t *testing.T) { + serial := filepath.Join(t.TempDir(), "serial.log") + cmd := exec.Command(os.Args[0], "-test.run=^TestVMExecutionProbeChild$") + cmd.Env = append(os.Environ(), "WOOTC_TEST_PROBE_CHILD="+mode, "WOOTC_TEST_PROBE_SERIAL="+serial) + var output bytes.Buffer + cmd.Stdout = &output + timeout := time.Second + if mode == "guest" { + timeout = 5 * time.Second + } + ctx, cancel := context.WithTimeout(context.Background(), timeout) + defer cancel() + result := runVMExecutionProbe(ctx, cmd, serial, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if mode == "stdout" && !strings.Contains(output.String(), vmProbeMarker) { + t.Fatal("stdout-only fixture did not execute") + } + if (result.Status == "passed") != (mode == "guest") { + t.Fatalf("mode %s: %+v", mode, result) + } + if (mode == "hung" || mode == "stdout") && result.Status != "timed_out" { + t.Fatalf("silence mislabeled unsupported: %+v", result) + } + }) + } +} +func TestVMExecutionProbeRefusesStaleLog(t *testing.T) { + serial := filepath.Join(t.TempDir(), "serial.log") + os.WriteFile(serial, []byte(vmProbeMarker), 0600) + result := runVMExecutionProbe(context.Background(), exec.Command("does-not-exist"), serial, func(*exec.Cmd) (io.Closer, error) { t.Fatal("started with stale log"); return nil, nil }) + if result.Status == "passed" { + t.Fatal("stale guest result accepted") + } +} +func TestVMProbeBootSectorReproducible(t *testing.T) { + if len(vmProbeBootSector) != 512 || fmt.Sprintf("%x", sha256.Sum256(vmProbeBootSector)) != "f591bb62b9fce510dc7a4a096940ffbfc596d925739416559017cfb2a92e7195" { + t.Fatal("probe binary changed; rebuild and verify source") + } +} diff --git a/app/vm_probe_windows.go b/app/vm_probe_windows.go new file mode 100644 index 00000000..51b23231 --- /dev/null +++ b/app/vm_probe_windows.go @@ -0,0 +1,72 @@ +//go:build windows + +package main + +import ( + "context" + "crypto/sha256" + "fmt" + "os" + "os/exec" + "path/filepath" + "time" +) + +func (a *App) probeVMRuntime(cap VMCapability) VMCapability { + a.vmProbeMu.Lock() + defer a.vmProbeMu.Unlock() + manifest, err := os.ReadFile(filepath.Join(qemuDir(), "SHA256SUMS")) + if err != nil { + cap.Available = false + cap.Reason = "The runtime manifest disappeared before the execution check." + return cap + } + key := fmt.Sprintf("%s:%x", cap.QEMUPath, sha256.Sum256(manifest)) + result := a.vmProbeResult + if a.vmProbeKey != key || time.Since(a.vmProbeAt) > time.Minute { + result = a.executeVMProbe(cap) + a.vmProbeKey = key + a.vmProbeResult = result + a.vmProbeAt = time.Now() + } + cap.ProbeStatus = result.Status + cap.Available = result.Status == "passed" + cap.Reason = result.Detail + if cap.Available { + cap.Accelerator = result.Accelerator + } + return cap +} + +func (a *App) executeVMProbe(cap VMCapability) vmExecutionProbeResult { + failed := vmExecutionProbeResult{Status: "failed", Detail: "Could not prepare the private VM execution check."} + if err := os.MkdirAll(previewDir(), 0700); err != nil { + return failed + } + dir, err := os.MkdirTemp(previewDir(), ".probe-") + if err != nil { + return failed + } + defer os.RemoveAll(dir) + disk := filepath.Join(dir, "probe.raw") + if err := os.WriteFile(disk, vmProbeBootSector, 0600); err != nil { + return failed + } + serial := filepath.Join(dir, "serial.log") + accelerator := "whpx,kernel-irqchip=off" + cmd := exec.Command(cap.QEMUPath, "-machine", "q35", "-accel", accelerator, "-cpu", "max", "-smp", "1", "-m", "128", "-display", "none", "-monitor", "none", "-serial", "file:"+serial, "-drive", "file="+qemuEscape(disk)+",format=raw,if=floppy,readonly=on", "-boot", "a") + cmd.Dir = qemuDir() + cmd.Env = vmProcessEnvironment(qemuDir(), dir) + cmd.SysProcAttr = vmProcessAttributes() + stderr, err := os.OpenFile(filepath.Join(dir, "stderr.log"), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + return failed + } + defer stderr.Close() + cmd.Stderr = stderr + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + result := runVMExecutionProbe(ctx, cmd, serial, ownVMProcess) + result.Accelerator = accelerator + return result +} diff --git a/app/vm_probe_windows_test.go b/app/vm_probe_windows_test.go new file mode 100644 index 00000000..897cf00b --- /dev/null +++ b/app/vm_probe_windows_test.go @@ -0,0 +1,42 @@ +//go:build windows + +package main + +import ( + "context" + "os" + "os/exec" + "path/filepath" + "testing" + "time" +) + +// Explicit fixture-only entry point. Production has no environment-selected +// runtime, public key, or TCG fallback. Corral supplies its isolated signed tree. +func TestVMExecutionProbeRealQEMU(t *testing.T) { + runtimeDir := os.Getenv("WOOTC_TEST_QEMU_RUNTIME") + if runtimeDir == "" { + t.Skip("requires isolated signed QEMU fixture") + } + if err := verifyVMRuntime(runtimeDir, os.Getenv("WOOTC_TEST_ARTIFACT_PUBLIC_KEY")); err != nil { + t.Fatal(err) + } + dir := t.TempDir() + disk := filepath.Join(dir, "probe.raw") + serial := filepath.Join(dir, "serial.log") + if err := os.WriteFile(disk, vmProbeBootSector, 0600); err != nil { + t.Fatal(err) + } + cmd := exec.Command(filepath.Join(runtimeDir, "qemu-system-x86_64.exe"), "-machine", "q35", "-accel", "tcg", "-cpu", "max", "-smp", "1", "-m", "128", "-display", "none", "-monitor", "none", "-serial", "file:"+serial, "-drive", "file="+qemuEscape(disk)+",format=raw,if=floppy,readonly=on", "-boot", "a") + cmd.Dir = runtimeDir + cmd.Env = vmProcessEnvironment(runtimeDir, dir) + cmd.SysProcAttr = vmProcessAttributes() + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + start := time.Now() + result := runVMExecutionProbe(ctx, cmd, serial, ownVMProcess) + t.Logf("Actual Windows QEMU q35/TCG execution: %s in %s", result.Status, time.Since(start)) + if result.Status != "passed" { + t.Fatalf("probe: %+v", result) + } +} diff --git a/app/vm_runtime.go b/app/vm_runtime.go index c9bb8bb6..da5898f6 100644 --- a/app/vm_runtime.go +++ b/app/vm_runtime.go @@ -30,7 +30,8 @@ func verifyVMRuntime(root, publicKey string) error { return err } seen := map[string]bool{} - return filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error { + verified := map[string]bool{} + err = filepath.WalkDir(root, func(path string, entry fs.DirEntry, walkErr error) error { if walkErr != nil { return walkErr } @@ -40,6 +41,9 @@ func verifyVMRuntime(root, publicKey string) error { if entry.IsDir() { return nil } + if !entry.Type().IsRegular() { + return fmt.Errorf("runtime contains a nonregular file: %s", path) + } relative, err := filepath.Rel(root, path) if err != nil { return err @@ -70,6 +74,16 @@ func verifyVMRuntime(root, publicKey string) error { if hex.EncodeToString(hash.Sum(nil)) != checksum { return fmt.Errorf("runtime checksum mismatch: %s", name) } + verified[name] = true return nil }) + if err != nil { + return err + } + for name := range expected { + if !verified[name] { + return fmt.Errorf("signed runtime file is missing: %s", name) + } + } + return nil } diff --git a/app/vm_runtime_test.go b/app/vm_runtime_test.go index 6b758c95..88d4086e 100644 --- a/app/vm_runtime_test.go +++ b/app/vm_runtime_test.go @@ -20,8 +20,8 @@ func TestVMRuntimeRequiresCompleteSignedClosure(t *testing.T) { root := t.TempDir() key := hex.EncodeToString(pub) content := []byte("trusted-runtime") - manifest := []byte(fmt.Sprintf("%x qemu-system-x86_64.exe\n", sha256.Sum256(content))) - for name, data := range map[string][]byte{"qemu-system-x86_64.exe": content, "SHA256SUMS": manifest, "SHA256SUMS.sig": artifactauth.Sign(private, manifest)} { + manifest := []byte(fmt.Sprintf("%x qemu-system-x86_64.exe\n%x required.dll\n", sha256.Sum256(content), sha256.Sum256(content))) + for name, data := range map[string][]byte{"qemu-system-x86_64.exe": content, "required.dll": content, "SHA256SUMS": manifest, "SHA256SUMS.sig": artifactauth.Sign(private, manifest)} { if err := os.WriteFile(filepath.Join(root, name), data, 0600); err != nil { t.Fatal(err) } @@ -42,6 +42,18 @@ func TestVMRuntimeRequiresCompleteSignedClosure(t *testing.T) { t.Fatal("replacement executable accepted") } os.WriteFile(filepath.Join(root, "qemu-system-x86_64.exe"), content, 0600) + if err := os.Remove(filepath.Join(root, "required.dll")); err != nil { + t.Fatal(err) + } + if err := verifyVMRuntime(root, key); err == nil { + t.Fatal("deleted signed DLL accepted as a complete runtime") + } + if err := os.WriteFile(filepath.Join(root, "required.dll"), content, 0600); err != nil { + t.Fatal(err) + } + if err := verifyVMRuntime(root, key); err != nil { + t.Fatal(err) + } other, _, _ := ed25519.GenerateKey(rand.Reader) if err := verifyVMRuntime(root, hex.EncodeToString(other)); err == nil { t.Fatal("untrusted signing key accepted") diff --git a/app/vm_windows.go b/app/vm_windows.go index df4a62de..5c907d49 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -30,6 +30,7 @@ type VMCapability struct { Accelerator string `json:"accelerator"` QEMUPath string `json:"qemuPath"` Bundled bool `json:"bundled"` + ProbeStatus string `json:"probeStatus"` } func qemuDir() string { return filepath.Join(wootcDir(), "qemu") } @@ -38,12 +39,14 @@ func edk2Code() string { return filepath.Join(qemuDir(), "share", "edk2-x86_64-c // GetVMCapability reports whether the installed disk can be booted in a VM. func (a *App) GetVMCapability() VMCapability { - cap := a.vmRuntimeCapability() state := a.GetVMState() - cap.DiskPath = state.DiskPath if state.Phase != vmReady && state.Phase != vmStopped { - cap.Available = false - cap.Reason = "No verified, stopped VM installation is ready. " + state.Error + return VMCapability{DiskPath: state.DiskPath, Reason: "No verified, stopped VM installation is ready. " + state.Error} + } + cap := a.vmRuntimeCapability() + cap.DiskPath = state.DiskPath + if cap.Available { + cap = a.probeVMRuntime(cap) } return cap } @@ -166,7 +169,7 @@ func (a *App) GetFreshVMCapability() VMCapability { cap.Reason = "The VM builder initramfs is missing." return cap } - return cap + return a.probeVMRuntime(cap) } // TryInVMFresh provisions one persistent raw disk, then launches its VM. diff --git a/app/vmprobe/serial-boot.S b/app/vmprobe/serial-boot.S new file mode 100644 index 00000000..3ff78afd --- /dev/null +++ b/app/vmprobe/serial-boot.S @@ -0,0 +1,35 @@ +.code16 +.global _start +_start: + cli + xor %ax, %ax + mov %ax, %ds + mov %ax, %ss + mov $0x7c00, %sp + mov $0x3fb, %dx + mov $0x80, %al + out %al, %dx + mov $0x3f8, %dx + mov $1, %al + out %al, %dx + inc %dx + xor %al, %al + out %al, %dx + mov $0x3fb, %dx + mov $3, %al + out %al, %dx + mov $message, %si +next: + lodsb + test %al, %al + jz done + mov $0x3f8, %dx + out %al, %dx + jmp next +done: + hlt + jmp done +message: + .asciz "WOOTC_WHPX_BOOTSECTOR_EXECUTED\r\n" +.org 510 +.word 0xaa55 diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/native-probe-tests.log b/docs/experiments/evidence/2026-09-26-managed-vm/native-probe-tests.log new file mode 100644 index 00000000..d250d319 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/native-probe-tests.log @@ -0,0 +1,67 @@ +Verified SHA256 f19722d8de42b8e381bb72e5f062d0ce290d0f82c2b0e287452eb1ee6f238df7 +=== RUN TestVMAccountInputIsPrivateTransientAndPreservesDisk +--- PASS: TestVMAccountInputIsPrivateTransientAndPreservesDisk (0.02s) +=== RUN TestVMAccountValidationDoesNotEchoPassword +--- PASS: TestVMAccountValidationDoesNotEchoPassword (0.00s) +=== RUN TestVMReceiptRequiresCreatedAccountIdentity +--- PASS: TestVMReceiptRequiresCreatedAccountIdentity (0.01s) +=== RUN TestVMOwnedJobReapsChildOnClose +--- PASS: TestVMOwnedJobReapsChildOnClose (0.17s) +=== RUN TestVMEnvironmentDoesNotInheritUserPluginPaths +--- PASS: TestVMEnvironmentDoesNotInheritUserPluginPaths (0.00s) +=== RUN TestVMReceiptRejectsProxySuccess +=== RUN TestVMReceiptRejectsProxySuccess/good +=== RUN TestVMReceiptRejectsProxySuccess/only-marker +=== RUN TestVMReceiptRejectsProxySuccess/wrong-run +=== RUN TestVMReceiptRejectsProxySuccess/wrong-image +=== RUN TestVMReceiptRejectsProxySuccess/wrong-disk +=== RUN TestVMReceiptRejectsProxySuccess/no-efi +=== RUN TestVMReceiptRejectsProxySuccess/duplicate +=== RUN TestVMReceiptRejectsProxySuccess/late-error +=== RUN TestVMReceiptRejectsProxySuccess/early-marker +--- PASS: TestVMReceiptRejectsProxySuccess (0.01s) + --- PASS: TestVMReceiptRejectsProxySuccess/good (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/only-marker (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-run (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-image (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/wrong-disk (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/no-efi (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/duplicate (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/late-error (0.00s) + --- PASS: TestVMReceiptRejectsProxySuccess/early-marker (0.00s) +=== RUN TestVMDurableStateAndNativeWriterGuard +--- PASS: TestVMDurableStateAndNativeWriterGuard (0.04s) +=== RUN TestVMExecutionProbeChild +--- PASS: TestVMExecutionProbeChild (0.00s) +=== RUN TestVMExecutionProbeNeedsActualSerial +=== RUN TestVMExecutionProbeNeedsActualSerial/guest +=== RUN TestVMExecutionProbeNeedsActualSerial/stdout +=== RUN TestVMExecutionProbeNeedsActualSerial/hung +=== RUN TestVMExecutionProbeNeedsActualSerial/exit +--- PASS: TestVMExecutionProbeNeedsActualSerial (2.45s) + --- PASS: TestVMExecutionProbeNeedsActualSerial/guest (0.38s) + --- PASS: TestVMExecutionProbeNeedsActualSerial/stdout (1.01s) + --- PASS: TestVMExecutionProbeNeedsActualSerial/hung (1.01s) + --- PASS: TestVMExecutionProbeNeedsActualSerial/exit (0.04s) +=== RUN TestVMExecutionProbeRefusesStaleLog +--- PASS: TestVMExecutionProbeRefusesStaleLog (0.00s) +=== RUN TestVMProbeBootSectorReproducible +--- PASS: TestVMProbeBootSectorReproducible (0.00s) +=== RUN TestVMExecutionProbeRealQEMU + vm_probe_windows_test.go:38: Actual Windows QEMU q35/TCG execution: passed in 1.1519078s +--- PASS: TestVMExecutionProbeRealQEMU (3.87s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (0.60s) + --- PASS: TestManagedVMShutdownContract/clean (0.10s) + --- PASS: TestManagedVMShutdownContract/host (0.08s) + --- PASS: TestManagedVMShutdownContract/crash (0.08s) + --- PASS: TestManagedVMShutdownContract/hung (0.33s) +=== RUN TestQMPRejectsMissingGreetingPromptly +--- PASS: TestQMPRejectsMissingGreetingPromptly (0.00s) +=== RUN TestVMRuntimeRequiresCompleteSignedClosure +--- PASS: TestVMRuntimeRequiresCompleteSignedClosure (0.04s) +PASS diff --git a/docs/managed-vm.md b/docs/managed-vm.md index 3f78d497..edb2b6c3 100644 --- a/docs/managed-vm.md +++ b/docs/managed-vm.md @@ -31,6 +31,15 @@ Its environment has an explicit allowlist. It does not inherit user PATH, GTK/GIO/QEMU module paths, or user configuration locations. WHPX must be enabled. The launcher selects `-cpu max`. +Before it enables preparation, the engine boots a small probe with WHPX. +The probe must emit a marker from actual guest code through a fresh serial file. +It uses a read-only disk with no operating system or user files. + +The check has a 30-second deadline. A timeout is inconclusive on a slow or busy PC; +it does not prove incompatibility. +The cache expires after one minute and keys on the signed manifest. +The measured mode is `whpx,kernel-irqchip=off`; there is no TCG fallback. + Each image still needs proof of CPU compatibility, especially with x86-64-v3. A process does not prove acceleration, guest boot, or a usable desktop. @@ -76,6 +85,11 @@ unless the user chooses to delete them. ## Stop, restart and recovery +The viewer disables an abrupt quit through GTK. +Use the visible **Shut down Linux** control in the main app, or shut down inside Linux. +The main app can also close itself: it first requests a guest shutdown. +These controls prevent a silent power cut when a user closes the window. + QMP uses private inherited pipes. A job object in Windows owns the QEMU process. The host creates QEMU suspended, assigns the job, then resumes it. A crash before assignment can leave an inert process, but no unowned writer. @@ -101,3 +115,18 @@ a desktop probe, and promotion of the same system to native boot. The shutdown evidence follows the [QEMU QMP reference](https://www.qemu.org/docs/master/interop/qemu-qmp-ref.html#event-SHUTDOWN). A guest request to power off does not prove that each application saved its documents. + +## Probe source + +The embedded boot sector is 512 bytes. Its source is in +`app/vmprobe/serial-boot.S`. Reproduce it with GNU binutils: + +```sh +as --32 app/vmprobe/serial-boot.S -o /tmp/probe.o +ld -m elf_i386 -Ttext 0x7c00 --oformat binary -e _start /tmp/probe.o -o /tmp/probe.img +sha256sum /tmp/probe.img app/vmprobe/serial-boot.img +``` + +Both hashes must be +`f591bb62b9fce510dc7a4a096940ffbfc596d925739416559017cfb2a92e7195`. +This probe proves execution of guest instructions, not Linux or desktop compatibility. diff --git a/shell/Wootc.Shell/Engine/Dto.cs b/shell/Wootc.Shell/Engine/Dto.cs index aa4b7d89..b3249b33 100644 --- a/shell/Wootc.Shell/Engine/Dto.cs +++ b/shell/Wootc.Shell/Engine/Dto.cs @@ -797,6 +797,9 @@ public class VMCapability [JsonPropertyName("bundled")] public bool Bundled { get; set; } + + [JsonPropertyName("probeStatus")] + public string ProbeStatus { get; set; } = string.Empty; } /// diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index 7d322ac8..dc038dbf 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -561,3 +561,27 @@ test('last-run phase display uses its backend label safely', async ({ page }) => await expect(page.locator('body')).toContainText(label); expect(await page.evaluate(() => window.phaseInjected)).toBeUndefined(); }); + +test('VM-first account flow uses only implemented choices and supports clean restart', async ({ page }) => { + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: true, probeStatus: 'passed' }, vm: { available: true } }); + await page.locator('.field:has-text("Linux Username") input').fill('alice'); + const password = page.locator('input[type=password]'); + await password.nth(0).fill('temporary-test-password'); + await password.nth(1).fill('different'); + await expect(page.locator('#vm-prepare-btn')).toBeDisabled(); + await password.nth(1).fill('temporary-test-password'); + await expect(page.locator('#vm-prepare-btn')).toHaveClass(/btn-primary/); + await expect(page.locator('#plan-note')).toContainText('apply only to installation with a reboot'); + await page.locator('#vm-prepare-btn').click(); + await expect(page.getByRole('heading', { name: 'Linux is starting' })).toBeVisible(); + const calls = await page.evaluate(() => window.__wootcVMCalls); + expect(calls[0][0]).toBe('prepare'); + expect(calls[0][1].username).toBe('alice'); + expect(calls[0][1].password).toBe('temporary-test-password'); + expect(Object.keys(calls[0][1]).sort()).toEqual(['imageRef', 'password', 'username']); + await expect(page.locator('body')).not.toContainText('temporary-test-password'); + await page.getByRole('button', { name: 'Shut down Linux', exact: true }).click(); + await expect(page.getByRole('button', { name: 'Start Linux again' })).toBeVisible(); + await page.getByRole('button', { name: 'Start Linux again' }).click(); + expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['prepare', 'stop', 'boot']); +}); diff --git a/tests/gui/mock-backend.js b/tests/gui/mock-backend.js index 67b3558f..48ff9e9a 100644 --- a/tests/gui/mock-backend.js +++ b/tests/gui/mock-backend.js @@ -6,6 +6,8 @@ // window.runtime.EventsOn/EventsEmit — we implement exactly those. window.__wootcInstallEmitters = []; +window.__wootcVMEmitters = []; +window.__wootcVMCalls = []; function makeApp(mock) { const P = (v) => Promise.resolve(v); @@ -70,7 +72,11 @@ function makeApp(mock) { GetUninstallInfo: () => P(mock.uninstall || { found: false }), UninstallWith: () => P(), GetVMCapability: () => P(mock.vm || { available: false, reason: '' }), - BootInVM: () => P(), + GetVMState: () => P(mock.vmState || { phase: 'absent', desktopReady: false }), + BootInVM: () => { window.__wootcVMCalls.push(['boot']); mock.vmState = { phase: 'running', desktopReady: false }; return P(); }, + PrepareVM: (cfg) => { window.__wootcVMCalls.push(['prepare', cfg]); mock.vmState = { phase: 'running', desktopReady: false }; setTimeout(() => window.__wootcVMEmitters.forEach(cb => cb({ stage: 'started', message: 'Guest not yet verified' })), 20); return P(); }, + StopVM: () => { window.__wootcVMCalls.push(['stop']); mock.vmState = { phase: 'stopped', desktopReady: false }; return P(); }, + ForceStopVM: () => { window.__wootcVMCalls.push(['force']); mock.vmState = { phase: 'needs_recovery', desktopReady: false }; return P(); }, GetFreshVMCapability: () => P(mock.freshVm || { available: false, reason: '' }), TryInVMFresh: () => P(), InstallPreviewForReal: () => P(), @@ -86,6 +92,7 @@ window.__wootcWindowCalls = []; window.runtime = { EventsOnMultiple: (name, cb) => { if (name === 'install:progress') window.__wootcInstallEmitters.push(cb); + if (name === 'vm:progress') window.__wootcVMEmitters.push(cb); return () => {}; }, EventsOn: (name, cb) => window.runtime.EventsOnMultiple(name, cb, -1), From 8f4fabc4721f7fab9a64c1f8757487c02e2df6e0 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:37:37 +0000 Subject: [PATCH 07/33] Include the reproducible read-only VM execution probe sector --- app/vmprobe/serial-boot.img | Bin 0 -> 512 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100755 app/vmprobe/serial-boot.img diff --git a/app/vmprobe/serial-boot.img b/app/vmprobe/serial-boot.img new file mode 100755 index 0000000000000000000000000000000000000000..ada18dea3d3fd1b6f18c99638d73c8f2e61c7cec GIT binary patch literal 512 zcmexmc%bh_--SI4HM@Q@Z)kY8>j(1&#&=Ez2i}4B% Date: Sat, 26 Sep 2026 18:41:56 +0000 Subject: [PATCH 08/33] Escape distro names in QEMU option values --- app/vm_managed_windows.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/vm_managed_windows.go b/app/vm_managed_windows.go index 6673e1aa..88b8cdd2 100644 --- a/app/vm_managed_windows.go +++ b/app/vm_managed_windows.go @@ -168,7 +168,7 @@ func (a *App) launchManagedDesktop(cap VMCapability, state VMState, release func "-drive", "if=pflash,format=raw,readonly=on,file=" + qemuEscape(edk2Code()), "-drive", "if=pflash,format=raw,file=" + qemuEscape(managedVMVars()), "-nic", "user", "-display", "gtk,window-close=off,show-menubar=off", "-qmp", "stdio", "-monitor", "none", - "-name", effectiveBranding().Name + " (VM)"} + "-name", qemuEscape(effectiveBranding().Name + " (VM)")} cmd := exec.Command(cap.QEMUPath, args...) cmd.Dir = filepath.Dir(cap.QEMUPath) cmd.Env = vmProcessEnvironment(cmd.Dir, previewDir()) From 2f3e42e5c1f52837c5d3c64ce78defaa92a99a54 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:56:12 +0000 Subject: [PATCH 09/33] Acquire the signed VM runtime with bounded setup and space monitoring --- app/frontend/src/main.js | 6 ++ app/frontend/src/screens/launchpad.js | 9 +- app/frontend/src/screens/vmpreview.js | 29 +++-- app/frontend/wailsjs/go/main/App.js | 2 + app/serve.go | 6 ++ app/testdata/dto/vm_capability.json | 3 +- app/vm_image_windows.go | 19 +++- app/vm_managed_windows.go | 3 + app/vm_other.go | 19 ++-- app/vm_runtime_acquire.go | 138 ++++++++++++++++++++++++ app/vm_runtime_acquire_test.go | 148 ++++++++++++++++++++++++++ app/vm_runtime_acquire_windows.go | 72 +++++++++++++ app/vm_space.go | 38 +++++++ app/vm_space_test.go | 42 ++++++++ app/vm_windows.go | 29 +++-- docs/managed-vm.md | 20 +++- docs/winui-shell.md | 1 + shell/Wootc.Shell/Engine/Dto.cs | 3 + tests/gui/gui.spec.js | 16 +++ tests/gui/mock-backend.js | 1 + 20 files changed, 569 insertions(+), 35 deletions(-) create mode 100644 app/vm_runtime_acquire.go create mode 100644 app/vm_runtime_acquire_test.go create mode 100644 app/vm_runtime_acquire_windows.go create mode 100644 app/vm_space.go create mode 100644 app/vm_space_test.go diff --git a/app/frontend/src/main.js b/app/frontend/src/main.js index 0a512f92..e39cc760 100644 --- a/app/frontend/src/main.js +++ b/app/frontend/src/main.js @@ -48,6 +48,12 @@ async function init() { if (['stopped', 'needs_recovery'].includes(e.stage)) state.vmState = { phase: e.stage, error: e.message }; if (e.stage === 'needs_recovery') state.vmError = e.message; if (e.stage === 'error') state.vmError = e.message; + if (e.stage === 'runtime-ready') { + try { state.freshVmCapability = await GetFreshVMCapability(); } catch (e) { state.vmError = String(e); } + if (state.freshVmCapability?.available) state.screen = 'launchpad'; + else state.vmError = state.vmError || state.freshVmCapability?.reason || 'The Linux window check did not finish.'; + render(); return; + } if (['stopped', 'needs_recovery', 'started'].includes(e.stage)) { try { state.vmState = await GetVMState(); state.vmCapability = await GetVMCapability(); } catch {} } diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index be530b6d..0723eacc 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -6,7 +6,7 @@ import { render } from '../lib/render.js'; import { installVerb, distroName, productName } from '../lib/branding.js'; import { el, btn, chip, warningBanner, inputField } from '../lib/ui.js'; import { renderProgress } from './progress.js'; -import { tryInVM } from './vmpreview.js'; +import { tryInVM, installVMRuntime } from './vmpreview.js'; const escapePhaseLabel = value => String(value).replace(/[&<>"']/g, c => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' })[c]); @@ -360,6 +360,13 @@ export function renderLaunchpad() { const vmBtn = btn(`Start ${distroName()} in a window`, 'btn btn-primary', () => tryInVM()); vmBtn.id = 'vm-prepare-btn'; footer.appendChild(vmBtn); } + if (state.freshVmCapability?.runtimeNeeded) { + footer.appendChild(btn('Set up Linux in a window', 'btn btn-primary', () => installVMRuntime())); + } + if (!state.freshVmCapability?.available && state.freshVmCapability?.reason) { + const vmReason = el('div'); vmReason.style.cssText = 'font-size:12px;color:var(--text-muted)'; + vmReason.textContent = state.freshVmCapability.reason; fields.appendChild(vmReason); + } footer.appendChild(installBtn); // Defer validity to after mount so the hint element exists. setTimeout(refreshInstallValidity, 0); diff --git a/app/frontend/src/screens/vmpreview.js b/app/frontend/src/screens/vmpreview.js index b87d3d3e..4b457e74 100644 --- a/app/frontend/src/screens/vmpreview.js +++ b/app/frontend/src/screens/vmpreview.js @@ -1,9 +1,11 @@ -import { PrepareVM, StopVM, ForceStopVM, BootInVM, GetUninstallInfo, GetVMState, GetVMCapability } from '../../wailsjs/go/main/App'; +import { PrepareVM, InstallVMRuntime, StopVM, ForceStopVM, BootInVM, GetUninstallInfo, GetVMState, GetVMCapability } from '../../wailsjs/go/main/App'; import { state } from '../lib/state.js'; import { render } from '../lib/render.js'; import { distroName } from '../lib/branding.js'; import { el, btn } from '../lib/ui.js'; +const escapeText = value => String(value).replace(/[&<>"']/g, c => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c])); + // ── Try in VM (§6.1) ────────────────────────────────────────────────────────── export async function tryInVM() { @@ -13,9 +15,11 @@ export async function tryInVM() { state.vmProgress = { stage: 'pulling', percent: 0, message: 'Preparing the builder…' }; state.vmReady = false; state.vmError = null; + state.vmState = null; render(); try { - await PrepareVM({ imageRef: state.selected.imageRef, username: state.config.username, password: state.config.password }); + state.vmStartPromise = PrepareVM({ imageRef: state.selected.imageRef, username: state.config.username, password: state.config.password }); + await state.vmStartPromise; state.config.password = ''; state.config.passwordConfirm = ''; } catch (e) { state.vmError = String(e); @@ -23,6 +27,15 @@ export async function tryInVM() { } } +export async function installVMRuntime() { + state.screen = 'vmpreview'; state.vmReady = false; state.vmError = null; + state.vmState = null; + state.vmProgress = { stage: 'runtime-manifest', percent: 0, message: 'Checking this release…' }; + render(); + try { state.vmStartPromise = InstallVMRuntime(); await state.vmStartPromise; } + catch (e) { state.vmError = String(e); render(); } +} + export function renderVMPreviewScreen() { const wrap = el('div'); wrap.style.cssText = 'display:flex;flex-direction:column;flex:1;overflow:hidden'; @@ -33,13 +46,13 @@ export function renderVMPreviewScreen() { if (state.vmError) { screen.innerHTML = `
😕

Couldn't start the preview

-
${state.vmError}
`; +
${escapeText(state.vmError)}
`; const back = btn('Back', 'btn btn-ghost', () => { state.screen = 'launchpad'; render(); }); screen.appendChild(back); } else if (state.vmReady) { screen.innerHTML = `
🖥️

Linux is starting

-
${state.selected?.name || distroName()} is starting in its own window. Sign in with your Linux username and password when the login screen appears. Your work stays on this disk. To close Linux safely, use Shut down Linux below. Native boot is not available yet.
`; +
${escapeText(state.selected?.name || distroName())} is starting in its own window. Sign in with your Linux username and password when the login screen appears. Your work stays on this disk. To close Linux safely, use Shut down Linux below. Native boot is not available yet.
`; const row = el('div'); row.style.cssText = 'display:flex;gap:10px;margin-top:8px'; row.appendChild(btn('Shut down Linux', 'btn btn-primary', async () => { try { await StopVM(); state.vmState = { phase: 'stopped' }; state.vmReady = false; render(); } @@ -63,11 +76,15 @@ export function renderVMPreviewScreen() { const pct = Math.round(p.percent || 0); screen.innerHTML = `
🔨

Preparing your Linux system…

-
${p.message || 'Working…'}
+
${escapeText(p.message || 'Working…')}
-
+
Preparation is in progress.
`; + if (p.stage !== 'runtime-ready') screen.appendChild(btn('Cancel setup', 'btn btn-ghost', async () => { + try { await state.vmStartPromise; await ForceStopVM(); state.screen = 'launchpad'; render(); } + catch (e) { state.vmError = String(e); render(); } + })); } wrap.appendChild(screen); return wrap; diff --git a/app/frontend/wailsjs/go/main/App.js b/app/frontend/wailsjs/go/main/App.js index 7bf3313f..bf49ffe7 100644 --- a/app/frontend/wailsjs/go/main/App.js +++ b/app/frontend/wailsjs/go/main/App.js @@ -167,3 +167,5 @@ export function StopVM() { return window['go']['main']['App']['StopVM'](); } export function ForceStopVM() { return window['go']['main']['App']['ForceStopVM'](); } export function PrepareVM(config) { return window['go']['main']['App']['PrepareVM'](config); } + +export function InstallVMRuntime() { return window['go']['main']['App']['InstallVMRuntime'](); } diff --git a/app/serve.go b/app/serve.go index 73917a0a..677c1a63 100644 --- a/app/serve.go +++ b/app/serve.go @@ -54,6 +54,7 @@ var ProtocolMethods = []string{ "GetVMState", "TryInVMFresh", "PrepareVM", + "InstallVMRuntime", "BootInVM", "StopVM", "ForceStopVM", @@ -308,6 +309,11 @@ func (s *Server) dispatch(ctx context.Context, req jsonrpcRequest) (any, *jsonrp return s.app.GetFreshVMCapability(), nil case "GetVMState": return s.app.GetVMState(), nil + case "InstallVMRuntime": + if err := s.app.InstallVMRuntime(); err != nil { + return nil, &jsonrpcError{Code: errCodeInternal, Message: err.Error()} + } + return nil, nil case "PrepareVM": var cfg VMInstallConfig if err := unmarshalParams(req.Params, &cfg); err != nil { diff --git a/app/testdata/dto/vm_capability.json b/app/testdata/dto/vm_capability.json index 3e33ac6d..d0861c6f 100644 --- a/app/testdata/dto/vm_capability.json +++ b/app/testdata/dto/vm_capability.json @@ -5,5 +5,6 @@ "accelerator": "whpx,kernel-irqchip=off", "qemuPath": "C:\\wootc\\qemu\\qemu-system-x86_64.exe", "bundled": true, - "probeStatus": "passed" + "probeStatus": "passed", + "runtimeNeeded": false } diff --git a/app/vm_image_windows.go b/app/vm_image_windows.go index 725db126..b7949c8f 100644 --- a/app/vm_image_windows.go +++ b/app/vm_image_windows.go @@ -10,14 +10,13 @@ import ( ) func createVMImageFiles() error { - root, _ := windows.UTF16PtrFromString(wootcDir()) - var available, total, free uint64 - if err := windows.GetDiskFreeSpaceEx(root, &available, &total, &free); err != nil { + available, err := vmFreeBytes(wootcDir()) + if err != nil { return err } const capacity = uint64(40) << 30 - if available < 2*capacity { - return fmt.Errorf("VM preparation needs at least 80 GB free for the Linux disk and separate scratch space") + if available < 2*capacity+vmWindowsReserveBytes { + return fmt.Errorf("VM preparation needs at least 88 GB free for the Linux disk, scratch space and an 8 GB Windows reserve") } for _, path := range []string{managedVMRootDisk(), filepath.Join(previewDir(), "scratch.disk")} { file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0600) @@ -44,3 +43,13 @@ func createVMImageFiles() error { } return nil } + +func vmFreeBytes(root string) (uint64, error) { + pointer, err := windows.UTF16PtrFromString(root) + if err != nil { + return 0, err + } + var available, total, free uint64 + err = windows.GetDiskFreeSpaceEx(pointer, &available, &total, &free) + return available, err +} diff --git a/app/vm_managed_windows.go b/app/vm_managed_windows.go index 88b8cdd2..37175fd4 100644 --- a/app/vm_managed_windows.go +++ b/app/vm_managed_windows.go @@ -26,6 +26,9 @@ func (a *App) GetVMState() VMState { } if release, err := acquireVMLock(managedVMRootDisk()); err == nil { cleanupErr := removeVMAccountInputs(previewDir()) + if cleanupErr == nil { + cleanupErr = cleanupVMRuntimeStaging(wootcDir()) + } release() if cleanupErr != nil { return VMState{SchemaVersion: 1, Phase: vmRecovery, Error: cleanupErr.Error()} diff --git a/app/vm_other.go b/app/vm_other.go index 350b2615..2476730d 100644 --- a/app/vm_other.go +++ b/app/vm_other.go @@ -7,13 +7,14 @@ import "fmt" // VMCapability mirrors the Windows type so the frontend bindings are stable // across platforms. type VMCapability struct { - Available bool `json:"available"` - Reason string `json:"reason"` - DiskPath string `json:"diskPath"` - Accelerator string `json:"accelerator"` - QEMUPath string `json:"qemuPath"` - Bundled bool `json:"bundled"` - ProbeStatus string `json:"probeStatus"` + Available bool `json:"available"` + Reason string `json:"reason"` + DiskPath string `json:"diskPath"` + Accelerator string `json:"accelerator"` + QEMUPath string `json:"qemuPath"` + Bundled bool `json:"bundled"` + ProbeStatus string `json:"probeStatus"` + RuntimeNeeded bool `json:"runtimeNeeded"` } func (a *App) GetVMCapability() VMCapability { @@ -46,3 +47,7 @@ func (a *App) shutdownVM() {} func (a *App) PrepareVM(cfg VMInstallConfig) error { return fmt.Errorf("managed VMs are only available on Windows") } + +func (a *App) InstallVMRuntime() error { + return fmt.Errorf("the VM runtime is only available on Windows") +} diff --git a/app/vm_runtime_acquire.go b/app/vm_runtime_acquire.go new file mode 100644 index 00000000..50330dbe --- /dev/null +++ b/app/vm_runtime_acquire.go @@ -0,0 +1,138 @@ +package main + +import ( + "context" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "wootc/internal/runtimebundle" +) + +const vmRuntimeArchive = "wootc-vm-runtime.zip" + +// Use the same HTTPS-only, no-ambient-proxy transport as boot artifacts. Bound +// the download before extraction so a bad server cannot consume the host disk. +func downloadVMRuntime(ctx context.Context, client *http.Client, source, destination string, progress func(float64)) error { + if err := validateArtifactURL(source); err != nil { + return err + } + req, err := http.NewRequestWithContext(ctx, http.MethodGet, source, nil) + if err != nil { + return err + } + response, err := client.Do(req) + if err != nil { + return err + } + defer response.Body.Close() + if response.StatusCode != http.StatusOK { + return fmt.Errorf("VM runtime download: HTTP %d", response.StatusCode) + } + if response.ContentLength > runtimebundle.MaxArchiveBytes { + return fmt.Errorf("VM runtime archive exceeds the size limit") + } + file, err := os.OpenFile(destination, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + return err + } + complete := false + defer func() { + file.Close() + if !complete { + os.Remove(destination) + } + }() + buffer := make([]byte, 64*1024) + var written int64 + for { + if err := ctx.Err(); err != nil { + return err + } + n, readErr := response.Body.Read(buffer) + if n > 0 { + written += int64(n) + if written > runtimebundle.MaxArchiveBytes { + return fmt.Errorf("VM runtime archive exceeds the size limit") + } + if _, err := file.Write(buffer[:n]); err != nil { + return err + } + if progress != nil && response.ContentLength > 0 { + progress(float64(written) / float64(response.ContentLength)) + } + } + if readErr == io.EOF { + break + } + if readErr != nil { + return readErr + } + } + if err := file.Sync(); err != nil { + return err + } + if err := file.Close(); err != nil { + return err + } + complete = true + return nil +} + +type vmRuntimeAcquisition struct { + checksums func(context.Context, string) (map[string]string, error) + download func(context.Context, string, string, func(float64)) error + install func(context.Context, string, string, string, string) error +} + +// The caller owns the image lease and has audited parent. No root disk or +// lifecycle state is created or removed by this operation. +func acquireVMRuntime(ctx context.Context, parent, baseURL, publicKey string, deps vmRuntimeAcquisition, emit func(VMEvent)) error { + if _, err := os.Lstat(filepath.Join(parent, "qemu")); !os.IsNotExist(err) { + return fmt.Errorf("a VM runtime directory already exists; preserve it for verification or repair") + } + emit(VMEvent{Stage: "runtime-manifest", Message: "Checking whether this release includes Linux in a window…"}) + sums, err := deps.checksums(ctx, filepath.Join(parent, "install")) + if err != nil { + return err + } + hash, ok := sums[vmRuntimeArchive] + if !ok { + return fmt.Errorf("this release does not include the Linux window runtime yet; use a release that includes it") + } + stage, err := os.MkdirTemp(parent, ".runtime-download-") + if err != nil { + return err + } + defer os.RemoveAll(stage) + archive := filepath.Join(stage, vmRuntimeArchive) + emit(VMEvent{Stage: "runtime-download", Message: "Downloading the Linux window runtime…"}) + if err := deps.download(ctx, baseURL+vmRuntimeArchive, archive, func(fraction float64) { + emit(VMEvent{Stage: "runtime-download", Percent: fraction * 100, Message: "Downloading the Linux window runtime…"}) + }); err != nil { + return err + } + emit(VMEvent{Stage: "runtime-verify", Message: "Verifying and installing the Linux window runtime…"}) + if err := deps.install(ctx, archive, parent, hash, publicKey); err != nil { + return err + } + return nil +} + +// Interrupted downloads/extractions use reserved private prefixes. Hold the +// image lease and audit parent before calling; never remove qemu or user disks. +func cleanupVMRuntimeStaging(parent string) error { + for _, pattern := range []string{".runtime-download-*", ".qemu-stage-*"} { + paths, err := filepath.Glob(filepath.Join(parent, pattern)) + if err != nil { + return err + } + for _, path := range paths { + if err := os.RemoveAll(path); err != nil { + return fmt.Errorf("could not remove interrupted runtime staging") + } + } + } + return nil +} diff --git a/app/vm_runtime_acquire_test.go b/app/vm_runtime_acquire_test.go new file mode 100644 index 00000000..4d835fc3 --- /dev/null +++ b/app/vm_runtime_acquire_test.go @@ -0,0 +1,148 @@ +package main + +import ( + "context" + "fmt" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" +) + +func TestRuntimeAcquisitionNeedsSignedReleaseEntryBeforeDownload(t *testing.T) { + root := t.TempDir() + disk := filepath.Join(root, "root.disk") + os.WriteFile(disk, []byte("user work"), 0600) + deps := vmRuntimeAcquisition{ + checksums: func(context.Context, string) (map[string]string, error) { + return map[string]string{"vmlinuz": "hash"}, nil + }, + download: func(context.Context, string, string, func(float64)) error { + t.Fatal("downloaded an unpublished runtime") + return nil + }, + install: func(context.Context, string, string, string, string) error { + t.Fatal("installed an unpublished runtime") + return nil + }, + } + if err := acquireVMRuntime(context.Background(), root, "https://release.invalid/", "key", deps, func(VMEvent) {}); err == nil { + t.Fatal("unpublished release appeared successful") + } + data, err := os.ReadFile(disk) + if err != nil || string(data) != "user work" { + t.Fatal("acquisition touched the user disk") + } +} +func TestRuntimeAcquisitionPassesAuthenticatedHashAndCleansDownload(t *testing.T) { + root := t.TempDir() + var archive string + installed := false + deps := vmRuntimeAcquisition{ + checksums: func(context.Context, string) (map[string]string, error) { + return map[string]string{vmRuntimeArchive: "authenticated-hash"}, nil + }, + download: func(ctx context.Context, source, dest string, progress func(float64)) error { + archive = dest + if source != "https://release.invalid/"+vmRuntimeArchive { + t.Fatal(source) + } + return os.WriteFile(dest, []byte("archive"), 0600) + }, + install: func(ctx context.Context, path, parent, hash, key string) error { + if path != archive || parent != root || hash != "authenticated-hash" || key != "embedded-key" { + t.Fatal("authentication identity changed") + } + installed = true + return nil + }, + } + if err := acquireVMRuntime(context.Background(), root, "https://release.invalid/", "embedded-key", deps, func(VMEvent) {}); err != nil { + t.Fatal(err) + } + if !installed { + t.Fatal("no install") + } + if _, err := os.Stat(archive); !os.IsNotExist(err) { + t.Fatal("staged download retained") + } +} +func TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting(t *testing.T) { + for _, mode := range []string{"error", "oversize", "ok"} { + t.Run(mode, func(t *testing.T) { + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch mode { + case "error": + w.WriteHeader(404) + case "oversize": + w.Header().Set("Content-Length", fmt.Sprint(1<<30)) + default: + fmt.Fprint(w, "archive") + } + })) + defer server.Close() + dest := filepath.Join(t.TempDir(), "runtime.zip") + err := downloadVMRuntime(context.Background(), server.Client(), server.URL, dest, nil) + if (err == nil) != (mode == "ok") { + t.Fatalf("mode %s: %v", mode, err) + } + if mode != "ok" { + if _, err := os.Stat(dest); !os.IsNotExist(err) { + t.Fatal("bad response left archive") + } + return + } + if err := downloadVMRuntime(context.Background(), server.Client(), server.URL, dest, nil); err == nil { + t.Fatal("existing archive overwritten") + } + data, _ := os.ReadFile(dest) + if string(data) != "archive" { + t.Fatal("existing bytes changed") + } + }) + } +} + +func TestRuntimeCrashCleanupPreservesPublishedRuntimeAndUserDisk(t *testing.T) { + root := t.TempDir() + for _, dir := range []string{".runtime-download-interrupted", ".qemu-stage-interrupted", "qemu", "disks"} { + os.Mkdir(filepath.Join(root, dir), 0700) + os.WriteFile(filepath.Join(root, dir, "sentinel"), []byte("keep"), 0600) + } + if err := cleanupVMRuntimeStaging(root); err != nil { + t.Fatal(err) + } + for _, dir := range []string{"qemu", "disks"} { + data, err := os.ReadFile(filepath.Join(root, dir, "sentinel")) + if err != nil || string(data) != "keep" { + t.Fatalf("cleanup changed %s", dir) + } + } + for _, dir := range []string{".runtime-download-interrupted", ".qemu-stage-interrupted"} { + if _, err := os.Stat(filepath.Join(root, dir)); !os.IsNotExist(err) { + t.Fatalf("retained %s", dir) + } + } +} + +func TestRuntimeDownloadCancellationRemovesPartial(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Length", "1000000") + fmt.Fprint(w, "partial") + w.(http.Flusher).Flush() + <-r.Context().Done() + })) + defer server.Close() + dest := filepath.Join(t.TempDir(), "runtime.zip") + observed := false + err := downloadVMRuntime(ctx, server.Client(), server.URL, dest, func(float64) { observed = true; cancel() }) + if err == nil || !observed { + t.Fatalf("cancellation did not follow actual bytes: observed=%v err=%v", observed, err) + } + if _, err := os.Stat(dest); !os.IsNotExist(err) { + t.Fatal("partial archive retained") + } +} diff --git a/app/vm_runtime_acquire_windows.go b/app/vm_runtime_acquire_windows.go new file mode 100644 index 00000000..7ac23db4 --- /dev/null +++ b/app/vm_runtime_acquire_windows.go @@ -0,0 +1,72 @@ +//go:build windows + +package main + +import ( + "context" + "fmt" + "golang.org/x/sys/windows" + "os" + "path/filepath" + "time" + "wootc/internal/runtimebundle" +) + +// InstallVMRuntime starts only after explicit selection in the GUI or RPC. +// It never replaces an existing runtime and never changes a Linux disk. +func (a *App) InstallVMRuntime() error { + if previewMode() { + return fmt.Errorf("runtime installation is unavailable in the UI test harness") + } + root := wootcDir() + if err := prepareTrustedStateTree(root); err != nil { + return err + } + release, err := acquireVMLock(managedVMRootDisk()) + if err != nil { + return err + } + if _, err := os.Lstat(filepath.Join(root, "qemu")); !os.IsNotExist(err) { + release() + return fmt.Errorf("a VM runtime directory already exists; preserve it for verification or repair") + } + if err := cleanupVMRuntimeStaging(root); err != nil { + release() + return err + } + rootPointer, err := windows.UTF16PtrFromString(root) + if err != nil { + release() + return err + } + var available, total, free uint64 + if err := windows.GetDiskFreeSpaceEx(rootPointer, &available, &total, &free); err != nil { + release() + return err + } + if available < 2<<30 { + release() + return fmt.Errorf("runtime setup needs at least 2 GB free for its download, verified files and Windows reserve") + } + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute) + done := make(chan struct{}) + a.vmMu.Lock() + a.vmCancel = cancel + a.vmPrepareDone = done + a.vmMu.Unlock() + go func() { + defer close(done) + defer cancel() + defer release() + defer func() { a.vmMu.Lock(); a.vmCancel = nil; a.vmPrepareDone = nil; a.vmMu.Unlock() }() + deps := vmRuntimeAcquisition{checksums: fetchArtifactChecksums, download: func(ctx context.Context, source, dest string, progress func(float64)) error { + return downloadVMRuntime(ctx, artifactClient, source, dest, progress) + }, install: runtimebundle.Install} + if err := acquireVMRuntime(ctx, root, deployerBaseURL(), artifactPublicKey, deps, a.emitVM); err != nil { + a.emitVM(VMEvent{Stage: "error", Message: err.Error()}) + return + } + a.emitVM(VMEvent{Stage: "runtime-ready", Message: "The runtime is installed. Checking whether this PC can run Linux in a window…"}) + }() + return nil +} diff --git a/app/vm_space.go b/app/vm_space.go new file mode 100644 index 00000000..94771a1e --- /dev/null +++ b/app/vm_space.go @@ -0,0 +1,38 @@ +package main + +import ( + "context" + "fmt" + "time" +) + +const vmWindowsReserveBytes = uint64(8) << 30 + +// An admission check cannot reserve free space against other Windows apps. +// Recheck while the helper writes, and retain the cancellation cause for the UI. +func guardVMFreeSpace(parent context.Context, minimum uint64, interval time.Duration, sample func() (uint64, error)) (context.Context, func()) { + ctx, cancel := context.WithCancelCause(parent) + done := make(chan struct{}) + go func() { + defer close(done) + ticker := time.NewTicker(interval) + defer ticker.Stop() + for { + available, err := sample() + if err != nil { + cancel(fmt.Errorf("could not check the space reserved for Windows: %w", err)) + return + } + if available < minimum { + cancel(fmt.Errorf("preparation stopped because Windows free space fell below the 8 GB reserve; free more space before trying again")) + return + } + select { + case <-ctx.Done(): + return + case <-ticker.C: + } + } + }() + return ctx, func() { cancel(nil); <-done } +} diff --git a/app/vm_space_test.go b/app/vm_space_test.go new file mode 100644 index 00000000..7dff0d22 --- /dev/null +++ b/app/vm_space_test.go @@ -0,0 +1,42 @@ +package main + +import ( + "context" + "strings" + "testing" + "time" +) + +func TestVMFreeSpaceGuardObservesDropAndJoins(t *testing.T) { + samples := make(chan uint64, 2) + samples <- 200 + samples <- 50 + observed := make(chan uint64, 2) + ctx, stop := guardVMFreeSpace(context.Background(), 100, time.Millisecond, func() (uint64, error) { value := <-samples; observed <- value; return value, nil }) + defer stop() + select { + case <-ctx.Done(): + case <-time.After(time.Second): + t.Fatal("low space never stopped preparation") + } + if <-observed != 200 || <-observed != 50 { + t.Fatal("guard did not observe changing free space") + } + if !strings.Contains(context.Cause(ctx).Error(), "reserve") { + t.Fatal(context.Cause(ctx)) + } +} +func TestVMFreeSpaceGuardStopsWithParent(t *testing.T) { + parent, cancel := context.WithCancel(context.Background()) + observed := make(chan struct{}, 1) + _, stop := guardVMFreeSpace(parent, 100, time.Hour, func() (uint64, error) { observed <- struct{}{}; return 200, nil }) + <-observed + cancel() + done := make(chan struct{}) + go func() { stop(); close(done) }() + select { + case <-done: + case <-time.After(time.Second): + t.Fatal("space monitor outlived its worker") + } +} diff --git a/app/vm_windows.go b/app/vm_windows.go index 5c907d49..4909ebce 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -24,13 +24,14 @@ import ( // VMCapability tells the GUI whether "Boot in VM" can run and why not. type VMCapability struct { - Available bool `json:"available"` - Reason string `json:"reason"` - DiskPath string `json:"diskPath"` - Accelerator string `json:"accelerator"` - QEMUPath string `json:"qemuPath"` - Bundled bool `json:"bundled"` - ProbeStatus string `json:"probeStatus"` + Available bool `json:"available"` + Reason string `json:"reason"` + DiskPath string `json:"diskPath"` + Accelerator string `json:"accelerator"` + QEMUPath string `json:"qemuPath"` + Bundled bool `json:"bundled"` + ProbeStatus string `json:"probeStatus"` + RuntimeNeeded bool `json:"runtimeNeeded"` } func qemuDir() string { return filepath.Join(wootcDir(), "qemu") } @@ -119,17 +120,20 @@ func (a *App) vmRuntimeCapability() VMCapability { if err := prepareTrustedStateTree(wootcDir()); err != nil { return VMCapability{Reason: err.Error()} } + if _, err := os.Lstat(qemuDir()); os.IsNotExist(err) { + return VMCapability{RuntimeNeeded: true, Reason: "This release needs the Linux window runtime. Set it up to check whether this PC can run it."} + } if err := verifyVMRuntime(qemuDir(), artifactPublicKey); err != nil { return VMCapability{Reason: err.Error()} } qemuPath, bundled := findQEMU() cap := VMCapability{QEMUPath: qemuPath, Bundled: bundled} if qemuPath == "" { - cap.Reason = "QEMU isn't installed. Reinstall wootc with the VM viewer." + cap.Reason = "The Linux window runtime is incomplete. Install a complete signed runtime for this release." return cap } if _, err := os.Stat(edk2Code()); err != nil { - cap.Reason = "The VM firmware is missing. Reinstall wootc with the VM viewer." + cap.Reason = "The Linux window firmware is missing. Install a complete signed runtime for this release." return cap } if _, err := os.Stat(edk2VarsTemplate()); err != nil { @@ -305,6 +309,8 @@ func resolveVMImage(ctx context.Context, image string) (string, error) { } func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState, passwordHash string) (resultErr error) { + ctx, stopSpaceGuard := guardVMFreeSpace(ctx, vmWindowsReserveBytes, time.Second, func() (uint64, error) { return vmFreeBytes(wootcDir()) }) + defer stopSpaceGuard() accountPath, err := writeVMAccountInput(previewDir(), vmAccountInput{SchemaVersion: 1, RunID: state.RunID, InstallID: state.InstallID, Username: state.Username, PasswordHash: passwordHash}) if err != nil { return err @@ -346,9 +352,12 @@ func (a *App) runBuilderVM(ctx context.Context, cap VMCapability, state *VMState } defer job.Close() if err = cmd.Wait(); err != nil { + if cause := context.Cause(ctx); cause != nil { + return cause + } return fmt.Errorf("VM preparation did not complete: %w", err) } - if err = ctx.Err(); err != nil { + if err = context.Cause(ctx); err != nil { return err } log, err := os.Open(logPath) diff --git a/docs/managed-vm.md b/docs/managed-vm.md index edb2b6c3..7ba7f24e 100644 --- a/docs/managed-vm.md +++ b/docs/managed-vm.md @@ -4,11 +4,21 @@ The VM uses one Linux system in `:\wootc\disks\root.disk`. A restart reuses that image and `vm\firmware-vars.fd`. It does not redeploy Linux. Native promotion needs more proof (ADR 0004). -Standard releases still need a package and acquisition path for the runtime. +Standard releases still need to publish the signed runtime package. +The GUI offers explicit setup through `InstallVMRuntime`. An executable alone is insufficient. The engine checks the complete runtime against a signature before execution. An absent bundle makes the capability unavailable. It does not cause a silent fallback to native install. +Setup fetches the signed release manifest before it downloads +`wootc-vm-runtime.zip`. An absent entry gives a clear unavailable error. +The download has a 256 MiB limit. Extraction verifies the archive hash and +each signed file, then publishes the complete directory in one rename. + +Setup owns the image lock. It needs a protected parent and 2 GiB free. +Cancellation removes temporary files. A retry removes only reserved temporary +paths; it preserves an existing runtime and every Linux disk. + ## Runtime contract Stage QEMU for Windows 11.1.0 under `wootc\qemu`. @@ -49,7 +59,7 @@ A process does not prove acceleration, guest boot, or a usable desktop. |---|---| | Target and scratch | Separate 40 GiB raw files; serials `wootc-root` and `wootc-scratch` | | Helper memory | 3 GiB guest allocation; at least 6 GiB host RAM; lower-memory profiles need separate proof | -| Host capacity | At least 80 GiB free before file creation | +| Host capacity | At least 88 GiB free before file creation: target, scratch, and 8 GiB for Windows | | Image | Immutable OCI digest; fresh installation and run IDs | | Existing file | Never truncate or replace; preserve failed preparation for diagnosis | | Helper completion | Exit zero, one structured receipt, then `STATUS=SUCCESS` | @@ -57,9 +67,9 @@ A process does not prove acceleration, guest boot, or a usable desktop. | Receipt validation | `filesystemVerified=true`, `efiVerified=true`, `accountOutcome=created` and exact username | | Result transport | Private file-backed virtio channel owned by this QEMU launch; no public socket | -The 80 GiB gate is a conservative trial limit, not a measured physical minimum. -The files are sparse. Product defaults still need a measurement of peak physical -space on Windows, a reserve, and an abort before space runs low. +The 88 GiB gate is a conservative trial limit, not a measured physical minimum. +The files are sparse. The helper stops if free space falls below the Windows reserve. +Product defaults still need a measurement of peak physical space on Windows. A lighter image with a 2 GiB helper also needs proof for older PCs. These are P0 requirements for the consumer path. diff --git a/docs/winui-shell.md b/docs/winui-shell.md index 6cdd7cef..b533d4e0 100644 --- a/docs/winui-shell.md +++ b/docs/winui-shell.md @@ -228,6 +228,7 @@ Retain the legacy build until a native release passes its gates, before phase E | `GetFreshVMCapability` | — | `VMCapability` | Signed runtime and helper availability. | | `GetVMState` | — | `VMState` | Durable disk lifecycle; desktop readiness requires independent evidence. | | `TryInVMFresh` | image string | — | Legacy call refuses preparation without account details. | +| `InstallVMRuntime` | — | — | Acquire the signed runtime for this release; no native fallback or existing-runtime replacement. | | `PrepareVM` | `VMInstallConfig` | — | Prepare a persistent system with its Linux account, then launch its VM. | | `BootInVM` | — | — | Restart the same verified, stopped VM disk. | | `StopVM` | — | — | Request guest shutdown; preserve ownership until actual exit. | diff --git a/shell/Wootc.Shell/Engine/Dto.cs b/shell/Wootc.Shell/Engine/Dto.cs index b3249b33..e3c70e41 100644 --- a/shell/Wootc.Shell/Engine/Dto.cs +++ b/shell/Wootc.Shell/Engine/Dto.cs @@ -800,6 +800,9 @@ public class VMCapability [JsonPropertyName("probeStatus")] public string ProbeStatus { get; set; } = string.Empty; + + [JsonPropertyName("runtimeNeeded")] + public bool RuntimeNeeded { get; set; } } /// diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index dc038dbf..3e8e1365 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -585,3 +585,19 @@ test('VM-first account flow uses only implemented choices and supports clean res await page.getByRole('button', { name: 'Start Linux again' }).click(); expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['prepare', 'stop', 'boot']); }); + + +test('signed runtime setup returns to account setup without starting an install', async ({ page }) => { + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: false, runtimeNeeded: true } }); + await page.getByRole('button', { name: 'Set up Linux in a window' }).click(); + await expect(page.locator('#vm-prepare-btn')).toBeVisible(); + expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['runtime']); +}); + +test('a release without the runtime gives an explicit error without installing Linux', async ({ page }) => { + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: false, runtimeNeeded: true }, runtimeError: 'This release does not include the Linux window runtime yet.' }); + await page.getByRole('button', { name: 'Set up Linux in a window' }).click(); + await expect(page.locator('body')).toContainText('This release does not include the Linux window runtime yet.'); + expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['runtime']); + await expect(page.getByRole('button', { name: 'Back', exact: true })).toBeVisible(); +}); diff --git a/tests/gui/mock-backend.js b/tests/gui/mock-backend.js index 48ff9e9a..96201deb 100644 --- a/tests/gui/mock-backend.js +++ b/tests/gui/mock-backend.js @@ -74,6 +74,7 @@ function makeApp(mock) { GetVMCapability: () => P(mock.vm || { available: false, reason: '' }), GetVMState: () => P(mock.vmState || { phase: 'absent', desktopReady: false }), BootInVM: () => { window.__wootcVMCalls.push(['boot']); mock.vmState = { phase: 'running', desktopReady: false }; return P(); }, + InstallVMRuntime: () => { window.__wootcVMCalls.push(['runtime']); setTimeout(() => { if (mock.runtimeError) { window.__wootcVMEmitters.forEach(cb => cb({ stage: 'error', message: mock.runtimeError })); } else { mock.freshVm = { available: true, probeStatus: 'passed' }; window.__wootcVMEmitters.forEach(cb => cb({ stage: 'runtime-ready', message: 'Checking this PC' })); } }, 20); return P(); }, PrepareVM: (cfg) => { window.__wootcVMCalls.push(['prepare', cfg]); mock.vmState = { phase: 'running', desktopReady: false }; setTimeout(() => window.__wootcVMEmitters.forEach(cb => cb({ stage: 'started', message: 'Guest not yet verified' })), 20); return P(); }, StopVM: () => { window.__wootcVMCalls.push(['stop']); mock.vmState = { phase: 'stopped', desktopReady: false }; return P(); }, ForceStopVM: () => { window.__wootcVMCalls.push(['force']); mock.vmState = { phase: 'needs_recovery', desktopReady: false }; return P(); }, From 4f1e1da990015ad90447a08481d35c18a3b3d5a7 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 18:59:10 +0000 Subject: [PATCH 10/33] Record native runtime acquisition proof and check error text escaping --- .../native-acquisition-tests.log | 22 +++++++++++++++++++ tests/gui/gui.spec.js | 4 +++- 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/native-acquisition-tests.log diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/native-acquisition-tests.log b/docs/experiments/evidence/2026-09-26-managed-vm/native-acquisition-tests.log new file mode 100644 index 00000000..957a536c --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/native-acquisition-tests.log @@ -0,0 +1,22 @@ +Verified SHA256 d36dd9ee5f84f6da6be938add9b02c4ee890dc8fa643f6545b3809da3bd4ba08 +=== RUN TestRuntimeAcquisitionNeedsSignedReleaseEntryBeforeDownload +--- PASS: TestRuntimeAcquisitionNeedsSignedReleaseEntryBeforeDownload (0.02s) +=== RUN TestRuntimeAcquisitionPassesAuthenticatedHashAndCleansDownload +--- PASS: TestRuntimeAcquisitionPassesAuthenticatedHashAndCleansDownload (0.00s) +=== RUN TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting +=== RUN TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/error +=== RUN TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/oversize +=== RUN TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/ok +--- PASS: TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting (0.07s) + --- PASS: TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/error (0.02s) + --- PASS: TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/oversize (0.01s) + --- PASS: TestRuntimeDownloadRejectsErrorOversizeAndPreservesExisting/ok (0.04s) +=== RUN TestRuntimeCrashCleanupPreservesPublishedRuntimeAndUserDisk +--- PASS: TestRuntimeCrashCleanupPreservesPublishedRuntimeAndUserDisk (0.01s) +=== RUN TestRuntimeDownloadCancellationRemovesPartial +--- PASS: TestRuntimeDownloadCancellationRemovesPartial (0.01s) +=== RUN TestVMFreeSpaceGuardObservesDropAndJoins +--- PASS: TestVMFreeSpaceGuardObservesDropAndJoins (0.00s) +=== RUN TestVMFreeSpaceGuardStopsWithParent +--- PASS: TestVMFreeSpaceGuardStopsWithParent (0.00s) +PASS diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index 3e8e1365..5f73686c 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -595,9 +595,11 @@ test('signed runtime setup returns to account setup without starting an install' }); test('a release without the runtime gives an explicit error without installing Linux', async ({ page }) => { - await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: false, runtimeNeeded: true }, runtimeError: 'This release does not include the Linux window runtime yet.' }); + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: false, runtimeNeeded: true }, runtimeError: 'This release does not include the Linux window runtime yet. ' }); await page.getByRole('button', { name: 'Set up Linux in a window' }).click(); await expect(page.locator('body')).toContainText('This release does not include the Linux window runtime yet.'); + await expect(page.locator('body')).toContainText(''); + await expect(page.locator('img[src=x]')).toHaveCount(0); expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['runtime']); await expect(page.getByRole('button', { name: 'Back', exact: true })).toBeVisible(); }); From d2fbfd2c838e8849cb5ea932fbb75f69ca4f2d87 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 23:50:46 +0000 Subject: [PATCH 11/33] fix(vm): keep probe writes out of signed runtime --- app/vm_probe.go | 9 ++++++ app/vm_probe_test.go | 13 +++++++++ app/vm_probe_windows.go | 4 +-- .../windows-vm-probe-appcompat-2026-09-26.md | 28 +++++++++++++++++++ 4 files changed, 51 insertions(+), 3 deletions(-) create mode 100644 docs/experiments/windows-vm-probe-appcompat-2026-09-26.md diff --git a/app/vm_probe.go b/app/vm_probe.go index 74f4d6b8..f0d23109 100644 --- a/app/vm_probe.go +++ b/app/vm_probe.go @@ -16,6 +16,15 @@ var vmProbeBootSector []byte const vmProbeMarker = "WOOTC_WHPX_BOOTSECTOR_EXECUTED" +// newVMProbeCommand keeps the guest runtime in its authenticated bundle but +// runs QEMU from disposable state. Windows may write compatibility caches +// relative to the current directory; those files must not land in qemuDir(). +func newVMProbeCommand(qemuPath, workingDir string, args ...string) *exec.Cmd { + cmd := exec.Command(qemuPath, args...) + cmd.Dir = workingDir + return cmd +} + type vmExecutionProbeResult struct { Status string Detail string diff --git a/app/vm_probe_test.go b/app/vm_probe_test.go index 824b0eb1..b926ebb4 100644 --- a/app/vm_probe_test.go +++ b/app/vm_probe_test.go @@ -30,6 +30,19 @@ func TestVMExecutionProbeChild(t *testing.T) { time.Sleep(time.Minute) os.Exit(0) } +func TestVMProbeCommandRunsOutsideTheAuthenticatedRuntime(t *testing.T) { + root := t.TempDir() + runtimeDir := filepath.Join(root, "qemu") + privateDir := filepath.Join(root, "preview", ".probe-run") + cmd := newVMProbeCommand(filepath.Join(runtimeDir, "qemu-system-x86_64.exe"), privateDir, "-version") + if filepath.Clean(cmd.Dir) != filepath.Clean(privateDir) { + t.Fatalf("probe working directory = %q, want disposable directory %q", cmd.Dir, privateDir) + } + if filepath.Clean(cmd.Dir) == filepath.Clean(runtimeDir) { + t.Fatal("probe may write host-generated files into the authenticated runtime") + } +} + func TestVMExecutionProbeNeedsActualSerial(t *testing.T) { for _, mode := range []string{"guest", "stdout", "hung", "exit"} { t.Run(mode, func(t *testing.T) { diff --git a/app/vm_probe_windows.go b/app/vm_probe_windows.go index 51b23231..14798177 100644 --- a/app/vm_probe_windows.go +++ b/app/vm_probe_windows.go @@ -7,7 +7,6 @@ import ( "crypto/sha256" "fmt" "os" - "os/exec" "path/filepath" "time" ) @@ -54,8 +53,7 @@ func (a *App) executeVMProbe(cap VMCapability) vmExecutionProbeResult { } serial := filepath.Join(dir, "serial.log") accelerator := "whpx,kernel-irqchip=off" - cmd := exec.Command(cap.QEMUPath, "-machine", "q35", "-accel", accelerator, "-cpu", "max", "-smp", "1", "-m", "128", "-display", "none", "-monitor", "none", "-serial", "file:"+serial, "-drive", "file="+qemuEscape(disk)+",format=raw,if=floppy,readonly=on", "-boot", "a") - cmd.Dir = qemuDir() + cmd := newVMProbeCommand(cap.QEMUPath, dir, "-machine", "q35", "-accel", accelerator, "-cpu", "max", "-smp", "1", "-m", "128", "-display", "none", "-monitor", "none", "-serial", "file:"+serial, "-drive", "file="+qemuEscape(disk)+",format=raw,if=floppy,readonly=on", "-boot", "a") cmd.Env = vmProcessEnvironment(qemuDir(), dir) cmd.SysProcAttr = vmProcessAttributes() stderr, err := os.OpenFile(filepath.Join(dir, "stderr.log"), os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) diff --git a/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md new file mode 100644 index 00000000..3e888c11 --- /dev/null +++ b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md @@ -0,0 +1,28 @@ +# Windows VM capability probe mutates the signed runtime — 2026-09-26 + +The Corral WHPX app trial showed the VM-first action missing even though the +QEMU runtime archive had been authenticated. The exact capability response was: + +```json +{ + "available": false, + "reason": "runtime file is not signed: %SystemDrive%/ProgramData/Microsoft/Windows/Caches/cversions.2.db" +} +``` + +The first probe launched QEMU with its current directory set to +`C:\wootc\qemu`. Windows created `cversions.2.db` and two companion +compatibility-cache files in a literal `%SystemDrive%\ProgramData` path under +that directory. Those files were absent from the signed runtime manifest. On a +subsequent app start, the installer-state trust scan also rejected the +user-writable cache file. The manifest and trust checks behaved correctly; the +probe polluted the immutable runtime. + +The probe now runs from its private `.probe-*` workspace under the disposable +preview directory. QEMU and its DLLs remain in the authenticated `qemu` +bundle, and the workspace is removed when the probe exits. A regression test +asserts that the command working directory is outside the runtime directory. + +This fixes the specific runtime mutation found in the trial. Rebuild the +Windows app and repeat the visible first-launch test before treating the +VM-first capability gate as proven on Windows. From 3ebe45544372cad10fbd0bdd02e115d7380ed7be Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 23:54:31 +0000 Subject: [PATCH 12/33] docs: simplify Windows probe trial note --- .../windows-vm-probe-appcompat-2026-09-26.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md index 3e888c11..cc36efbb 100644 --- a/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md +++ b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md @@ -1,7 +1,7 @@ # Windows VM capability probe mutates the signed runtime — 2026-09-26 -The Corral WHPX app trial showed the VM-first action missing even though the -QEMU runtime archive had been authenticated. The exact capability response was: +The Corral test on Windows showed no VM-first action, though QEMU's runtime +archive passed its check. The capability response was: ```json { @@ -18,11 +18,11 @@ subsequent app start, the installer-state trust scan also rejected the user-writable cache file. The manifest and trust checks behaved correctly; the probe polluted the immutable runtime. -The probe now runs from its private `.probe-*` workspace under the disposable -preview directory. QEMU and its DLLs remain in the authenticated `qemu` -bundle, and the workspace is removed when the probe exits. A regression test -asserts that the command working directory is outside the runtime directory. +The probe now runs from its private `.probe-*` folder under the disposable +preview directory. QEMU and its DLLs stay in the signed `qemu` bundle. The +probe removes the folder when it exits. A regression test asserts that QEMU +starts outside the runtime folder. -This fixes the specific runtime mutation found in the trial. Rebuild the -Windows app and repeat the visible first-launch test before treating the -VM-first capability gate as proven on Windows. +The test found one way to change the signed runtime. Rebuild the Windows app +and repeat the visible first-launch test before you call VM-first ready on +Windows. From 227e4b0580eb9ec1413bc1e364053a7efd7a0c9e Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 00:50:48 +0000 Subject: [PATCH 13/33] docs: record blocked Windows probe retest --- .../windows-vm-probe-appcompat-2026-09-26.md | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md index cc36efbb..cc6e1ad8 100644 --- a/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md +++ b/docs/experiments/windows-vm-probe-appcompat-2026-09-26.md @@ -11,18 +11,28 @@ archive passed its check. The capability response was: ``` The first probe launched QEMU with its current directory set to -`C:\wootc\qemu`. Windows created `cversions.2.db` and two companion -compatibility-cache files in a literal `%SystemDrive%\ProgramData` path under -that directory. Those files were absent from the signed runtime manifest. On a +`C:\wootc\qemu`. Windows created `cversions.2.db` and two other app cache files +under a folder named `%SystemDrive%\ProgramData`. Those files were absent from the signed runtime manifest. On a subsequent app start, the installer-state trust scan also rejected the -user-writable cache file. The manifest and trust checks behaved correctly; the -probe polluted the immutable runtime. +user-writable cache file. The manifest and trust checks worked; the probe +changed the signed runtime. The probe now runs from its private `.probe-*` folder under the disposable preview directory. QEMU and its DLLs stay in the signed `qemu` bundle. The probe removes the folder when it exits. A regression test asserts that QEMU starts outside the runtime folder. -The test found one way to change the signed runtime. Rebuild the Windows app -and repeat the visible first-launch test before you call VM-first ready on +This trial shows that the probe can change the signed runtime. Rebuild the +Windows app and repeat the visible first-launch test before you call VM-first +ready on Windows. + +## Retest outcome + +The first rebuilt app lacked the public key that signed the test runtime. It +refused the runtime before the probe. I recovered the old app's public key and +checked the runtime signature on the build host. + +The KubeVirt log then reported a guest-agent shutdown event. Its VMI stayed +ready, but Windows did not reconnect QGA after a restart. I stopped the VMI +after 20 minutes and kept its PVC. This run did not confirm the probe fix on Windows. From c81fa2a17b21eddd377188ca31c83d9457a73de9 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 01:41:22 +0000 Subject: [PATCH 14/33] test(vm): drive the VM-first launchpad in GUI E2E --- app/frontend/src/lib/e2e.js | 66 ++++++++++++++++++++++++++++++++++++- tests/gui/gui.spec.js | 30 +++++++++++++++++ tests/gui/mock-backend.js | 6 ++++ 3 files changed, 101 insertions(+), 1 deletion(-) diff --git a/app/frontend/src/lib/e2e.js b/app/frontend/src/lib/e2e.js index 8664ef2a..de1253d7 100644 --- a/app/frontend/src/lib/e2e.js +++ b/app/frontend/src/lib/e2e.js @@ -72,6 +72,51 @@ function driveInstall(directive, state) { } } +async function drivePrepareVM(directive, state) { + if (window.__e2ePrepareVMRequested || state.screen !== 'launchpad') return; + await reportState(state, directive); + + // Selecting a catalog card or applying a custom image re-renders the + // launchpad. Do that first, then look up fresh input elements so the + // remaining values are written into the controls the user can see. + if (directive.image) { + const currentRef = state.selected?.imageRef || ''; + const card = [...document.querySelectorAll('.image-card')] + .find((candidate) => candidate.__imgRef === directive.image); + const imageInput = fieldByLabel('Custom supported OCI image'); + if (card && currentRef !== directive.image) { + card.click(); + } else if (!card && imageInput && currentRef !== directive.image) { + imageInput.value = directive.image; + if (imageInput.oninput) imageInput.oninput(); + } + } + + if (directive.image && state.selected?.imageRef === directive.image) { + await reportState(state, directive); + } + + const username = fieldByLabel('Linux Username'); + const passwords = document.querySelectorAll('input[type=password]'); + if (!username || passwords.length < 2) return; + + username.value = directive.username || ''; + if (username.oninput) username.oninput(); + for (const password of passwords) { + password.value = directive.password || ''; + if (password.oninput) password.oninput(); + } + + if (directive.image && state.selected?.imageRef !== directive.image) return; + await reportState(state, directive); + const button = document.getElementById('vm-prepare-btn'); + if (!button || button.disabled) return; + + window.__e2ePrepareVMRequested = true; + button.click(); + window.__e2ePrepareVMDriven = true; +} + async function reportState(state, directive) { // The harness reads imageMismatch to fail FAST when the directive's image // cannot be selected (see the integrity gate in driveInstall) — the @@ -91,6 +136,17 @@ async function reportState(state, directive) { selectedRef: state.selected?.imageRef || '', imageMismatch: !!(wantRef && state.screen === 'launchpad' && !window.__e2eInstallDriven && state.selected?.imageRef !== wantRef), + vmPrepareDriven: !!window.__e2ePrepareVMDriven, + freshVmAvailable: !!state.freshVmCapability?.available, + freshVmReason: state.freshVmCapability?.reason || '', + vmPrepareButtonVisible: !!document.getElementById('vm-prepare-btn'), + vmPrepareButtonDisabled: document.getElementById('vm-prepare-btn')?.disabled ?? null, + vmRuntimeButtonVisible: [...document.querySelectorAll('button')] + .some((button) => button.textContent.includes('Set up Linux in a window')), + vmImageMismatch: !!(window.__e2eWantVMImage && state.screen === 'launchpad' && + !window.__e2ePrepareVMDriven && state.selected?.imageRef !== window.__e2eWantVMImage), + vmReady: !!state.vmReady, + vmProgressStage: state.vmProgress?.stage || '', })); } @@ -108,7 +164,7 @@ export function startE2EDrive(state) { const directive = JSON.parse(raw); if (directive.schemaVersion !== 1 || typeof directive.runId !== 'string' || !directive.runId || !/^[0-9a-f]{32}$/.test(directive.directiveId) || - !['install', 'reboot'].includes(directive.action)) throw new Error('Invalid drive identity'); + !['install', 'reboot', 'prepare-vm'].includes(directive.action)) throw new Error('Invalid drive identity'); if (window.__e2eRunId && window.__e2eRunId !== directive.runId) throw new Error('Changed drive run'); window.__e2eRunId = directive.runId; if (directive.action === 'install') { @@ -121,6 +177,14 @@ export function startE2EDrive(state) { window.__e2eWantImage = directive.image || ''; driveInstall(directive, state); } + if (directive.action === 'prepare-vm') { + if (window.__e2ePrepareVMDirectiveId && window.__e2ePrepareVMDirectiveId !== directive.directiveId) { + throw new Error('Changed VM preparation directive'); + } + window.__e2ePrepareVMDirectiveId = directive.directiveId; + window.__e2eWantVMImage = directive.image || ''; + await drivePrepareVM(directive, state); + } if (directive.action === 'reboot' && state.screen === 'done' && window.__e2eInstallDriven && window.__e2eInstallDirectiveId === directive.directiveId && !window.__e2eRebootDriven) { window.__e2eRebootDriven = true; diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index 5f73686c..4812d43b 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -587,6 +587,36 @@ test('VM-first account flow uses only implemented choices and supports clean res }); +test('E2E drive observes the VM-first button and prepares through the real launchpad form', async ({ page }) => { + const password = 'temporary-vm-e2e-password'; + const image = IMAGES[1].imageRef; + await boot(page, { + mode: 'installer', images: IMAGES, sysinfo: SYSINFO, + freshVm: { available: true, probeStatus: 'passed' }, + driveDirective: JSON.stringify({ + action: 'prepare-vm', image, + username: 'alice', password, + }), + }); + + await expect(page.getByRole('heading', { name: 'Linux is starting' })).toBeVisible(); + const calls = await page.evaluate(() => window.__wootcVMCalls); + expect(calls.map(call => call[0])).toEqual(['prepare']); + expect(calls[0][1]).toEqual({ imageRef: image, username: 'alice', password }); + await expect(page.locator('body')).not.toContainText(password); + + await expect.poll(() => page.evaluate(() => window.__wootcE2EReports.some(report => + report.screen === 'launchpad' && report.freshVmAvailable && + report.vmPrepareButtonVisible && !report.vmPrepareButtonDisabled && + !report.vmImageMismatch + ))).toBe(true); + await expect.poll(() => page.evaluate(() => window.__wootcE2EReports.some(report => + report.screen === 'vmpreview' && report.freshVmAvailable && report.vmReady && + report.vmProgressStage === 'started' + ))).toBe(true); +}); + + test('signed runtime setup returns to account setup without starting an install', async ({ page }) => { await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: false, runtimeNeeded: true } }); await page.getByRole('button', { name: 'Set up Linux in a window' }).click(); diff --git a/tests/gui/mock-backend.js b/tests/gui/mock-backend.js index 96201deb..035f874b 100644 --- a/tests/gui/mock-backend.js +++ b/tests/gui/mock-backend.js @@ -8,6 +8,7 @@ window.__wootcInstallEmitters = []; window.__wootcVMEmitters = []; window.__wootcVMCalls = []; +window.__wootcE2EReports = []; function makeApp(mock) { const P = (v) => Promise.resolve(v); @@ -79,6 +80,11 @@ function makeApp(mock) { StopVM: () => { window.__wootcVMCalls.push(['stop']); mock.vmState = { phase: 'stopped', desktopReady: false }; return P(); }, ForceStopVM: () => { window.__wootcVMCalls.push(['force']); mock.vmState = { phase: 'needs_recovery', desktopReady: false }; return P(); }, GetFreshVMCapability: () => P(mock.freshVm || { available: false, reason: '' }), + E2EDriveDirective: () => P(mock.driveDirective || ''), + E2EDriveReport: (state) => { + try { window.__wootcE2EReports.push(JSON.parse(state)); } catch {} + return P(); + }, TryInVMFresh: () => P(), InstallPreviewForReal: () => P(), DefragDrive: () => { if (mock.defragError) return Promise.reject(mock.defragError); return P(); }, From f63f8b90c5e81ecf0c6865b3796d40999f1f197f Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 02:29:40 +0000 Subject: [PATCH 15/33] fix(ui): explain disabled VM start action --- app/frontend/src/screens/launchpad.js | 11 ++++++++++- tests/gui/gui.spec.js | 19 +++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index 0723eacc..916e1041 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -404,7 +404,16 @@ function refreshInstallValidity() { if (!btn) return; const c = state.config; const vmBtn = document.getElementById('vm-prepare-btn'); - if (vmBtn) vmBtn.disabled = !state.selected || !/^[a-z_][a-z0-9_-]{0,31}$/.test(c.username) || c.username === 'root' || !c.password || c.password !== c.passwordConfirm; + if (vmBtn) { + let vmReason = ''; + if (!state.selected) vmReason = 'Choose a Linux version above'; + else if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(c.username) || c.username === 'root') vmReason = 'Enter a valid Linux username below'; + else if (!c.password) vmReason = 'Set your Linux password below'; + else if (c.password !== c.passwordConfirm) vmReason = 'Passwords do not match'; + vmBtn.disabled = vmReason !== ''; + vmBtn.textContent = vmReason || `Start ${distroName()} in a window`; + vmBtn.title = vmReason; + } let reason = ''; // Preflight safety gates (#63) come FIRST: these are conditions under which // starting at all risks the user's data or leaves the machine half-converted. diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index 4812d43b..2fb2864f 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -586,6 +586,25 @@ test('VM-first account flow uses only implemented choices and supports clean res expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['prepare', 'stop', 'boot']); }); +test('VM-first action explains the next required account detail', async ({ page }) => { + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, + freshVm: { available: true, probeStatus: 'passed' } }); + + const vmButton = page.locator('#vm-prepare-btn'); + await expect(vmButton).toBeInViewport(); + await expect(vmButton).toBeDisabled(); + await expect(vmButton).toHaveText('Enter a valid Linux username below'); + + await page.locator('.field:has-text("Linux Username") input').fill('alice'); + await expect(vmButton).toHaveText('Set your Linux password below'); + const password = page.locator('input[type=password]'); + await password.nth(0).fill('temporary-guidance-password'); + await expect(vmButton).toHaveText('Passwords do not match'); + await password.nth(1).fill('temporary-guidance-password'); + await expect(vmButton).toBeEnabled(); + await expect(vmButton).toHaveText(/Start .* in a window/); +}); + test('E2E drive observes the VM-first button and prepares through the real launchpad form', async ({ page }) => { const password = 'temporary-vm-e2e-password'; From 81808d958da28598074c4321dcd1777245c80f82 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 02:34:29 +0000 Subject: [PATCH 16/33] docs(gui): show VM-first launchpad guidance --- docs/screenshots/15-vm-first-launchpad.png | Bin 0 -> 65154 bytes tests/gui/gui.spec.js | 1 + 2 files changed, 1 insertion(+) create mode 100644 docs/screenshots/15-vm-first-launchpad.png diff --git a/docs/screenshots/15-vm-first-launchpad.png b/docs/screenshots/15-vm-first-launchpad.png new file mode 100644 index 0000000000000000000000000000000000000000..ea9af3701e6c6c301060a4cc8f24e35f67c036dc GIT binary patch literal 65154 zcmd43WmguI}(3@={1&@V~r!_YO%$T3qSfyN?|2-hHr!|L}IEpv3|C-8#(k=lVqYt=08v>?{m}<) z+e~rTNG?S+l38E_Nc}$z7{CN-!fu5(?$ByV*P0+%>B+3MCm=P%N5AJs+kSu&lIyNG zoW?t!I^{T>Vg>hZlD)})lZ`J8{~riKgopeGMBzV~{RhZC1+f1EKT$t);{5~P;QiMT z{{hmVZ}zbN0IDb{&&PiNo(whf{XY$T8u&EwWQjQ`@zL3c@RavPT!s5v0%>HNt~S*4|E@&^ ze&tCNch70 zhey7~({^0rp4r*e6n+g+F2zB_IKXp*Hfk>9tEj!2ro;QuY2TQ%z`_5!O)I9dpN7(rsFYF=Nc^k6BQ~{`E*DY?3bN(W2d%JeM{(P zS|26p?1sJeGN*u&ea@`pcRtnV+sYctUKt@0wGRWsX7=)W2VVADX4HH7M>gz(+u;69<{pSbn zisy;^`ym`k`ywzGIyWt6$gIQp8i^eNPP!t+6;4H08P@0ue68OOwKRViWU-mIM!oXe<xpNB!#b7UFlHRj79O<&5{J1Badjow_%8+;wP6&fldD9@GQ^sAtdQ|7#2GL+iXTRJ;AM6`j=6ci zo;Grh0>!EIolV$atTnW~F3%yzbys=V6w16RsSf7zTo*8@RpqvO-2AKe$HQYs(a*dO zF!3tRn$irK7tyAr3^t>C{6bz^S9Tq?6Sb5^uM)(UgB-BK?8|npsBqN%22R>JtI@t1 z@;O2o*?KgXF_B~E#TFJ1_j2a5BN~lBMOe)};D&A@Hva_@jY6ZhFWV*PF|2?F;1N<- zmN-?IU!84b-_ni$q(Q6HkC%KGBXOEjVZT9JN0SZe`$bXbatP4iv&wjkCx=DpPY@?8 z7Tp+&BZDPQ33nZLO6&;>Ter+`mN$G5Q>cjfs(1Xn*$DP&mUKRH8e0MN?<5P{&mXSb zoylih&se#w`5DXiRtsHGk3BXD*mrMvUH3$F!Hhwzb=fWkybrt0^xgN;VnFI0-={4k zr@rNdvd4*8-G=IA8%9Qtn8izrcUfyOIlX!9eJ)uId5@0N+1$+v9eJ8PN8>&!T1}z8 zK7L@%w4F|lzs^Umj#6t^mQAHA?DZ8_j?}8g*QLZPeC|!k5io0D1zyo*cRItRz4qt@ z1>MrUvRSpnoSBG9_z1fPUP)I$o2k>L`1e?kUrx}$KD|cwgCR$l>`)qL4f*ezx|cv( zIXnIJO?Gr&?3jLW9avw|_9z~BgCpZ0zQ z_I~b1;pscg5WK-RGr0{Z#QPAGr@q$4_Pa!?6*?RtY4jQ-A+hj<%tm8v2^c9YS}e@V z_f3HjT2pW|HDnu^Dy^so=22CCu(?5HtTLb2JSQUx?=~X`jCKZgC%`o-q{J(RDfH-z)&YS5btUj;W3%_!3$lp#-GMC6`mA%w zRP`rz+bfMf_@%fAu|pn_oCOLD*ahe)kWd&Sbau6E-QYsfFS=R3c;FkKjb_zn6}hkq z*eb~=p$|nHlCB)cKV}vbv=!jm>LId5R_$sOOC&Y^>Vb~@d5XqqAU<=;P1UDm^1GWg z=^52lODG&n+nhd;6<%ooV_KtQ_R*A` z_N{OIT3yLc9q5VPs7L;&G+J|H3KQxhft&HsMdvVnjO6anCSLc@smR>*7hn&L;kiUM zMb7C-9jg&e^5~#C5;1?#h(~<=8nLY#soy(lGBuHC2BslQq#18VXVfifW}3}J zPGy|Xp=bjR!e`gHU!ai)-5MUysvJWkxiZeqhKshQAm-vh6YIr-!?T5?l%$Buj#u&#b1|o4!d#L-C(bI=h#8X+lMY`!+}H6Eiz4|`)0R5 zk*w9?)tNQtwkb`aR3;_NJu(4@S+McZX<9)jrbqABJj%RSWx0`W`A!o4KgKGi(qD1_ z#qy<2c_w^$P7lYWdONU@Xk(Q><`znwawE50koj5Yvhl@x($S(tu6V3*CT#rDBR{_T zixOk?`{K$j^lA#@a+ob;LMP;P*RFg?1%s(DPts(-Jfp8gi)eM!+=6H2YYq;zaS6vj zV7h8O9fB|2F`l&*2Qwte-YPVNiK??Z?yI;_S)$Zq$hqp=Y-WspQqqvk6pBJekXwoC z+AOSO(06Q{K$XYgR+XRM3l-y*jx%gKW44}lC%ONWh83jR{Mh+bD9JJq*lA2ferb%a zKzvF;{#|=XMs;};VH=?h2+(G);XVtPD=gbt%^9&e{d`i z1E;`L|`H%&dR zJT_er%Tb9QJO9z$9Cdy_ITM==Do|Gn7YOX<6maxNnLBd!+TT#QOnZ$)piu0#xVHdP z*sq`SgpBI3MT&@Z<7hy(a1T!|;fMB;`H)YEoO<77*SBmew(Zjzk@~Ditu^dR#TF7b zB8Z{gzeipu(q@UBvmp@tV@NEXFW(U1m#J$UxrTpMrqgN5aTnQ>A#q z$6+FHPB1Fx)=9DpnT;Y-?$VraN}!T@Ya*70EwjQglK^65u~b`+1OW9{C^lp4e2%BK z>ZitFDmTcdcjFh>hG!z~Mfc$`!A`^u+hU1@W9BzCAu+!u#UXLefQ2=f5vZIF={74$P{mJh9(5dNLyXU9IyYM~8qg`|2<3}5Q4!%b`_KCW1 zkFGW$Ote$tKT5|;N>P7jDvjg1yAr-q6o1T`KKE-odOkry-eOre$yUp$lMB7m=1Ylu zR;Rz^p1B3NKr-a_Vn2jezZMz4h|lFHH$UyDtL+FXGfBz_d)i*bN~XGU_}q8#13Z29 zFsn1-5jZ(-@)JyYvhGHzLd@c}=IgA^79TI^hcU+(VJ6@M`27o(=S^jfsGLSlr0PetH;bD1W z(eg^7$d$0{R3s@iqX*BrVVqLtvyR-Ei1$^ZNxnH+O$5A~S#{rL;g`fZr)FEz=!e<_ z8Cx5hI<;)>v;LCZA0XJX2Gj6ON7L-x$J2Ef1aO#(*GL($myRSGxYBnV11@F#}@Y^v|N#2h}0&$Le zBP)X7WGsX307eY0sss90jTQb67jQ@5_dHw-=mF{|cSMYEo;_bM zvx1)%F1MYCGE<6TiFKDejuI7?b*tc)0o@DgQ_~h5`|r))<_wTvS3*a#FJjt=De;(a z_Rd+wXLT10zB6#!IuB44?(o>Q9PR7Yr`}`K^6aLgazqBXd>r+H4GsGgThkbt;V@;% z)LUg&!l%W5VfikB#pj@pumkFFv2qld)t-Dtq8betUQnS11GgEqox5xQO2qdsg$eb` z1hBW^C?+Vj{lfKIFrBrsq^GxZN#&JXwK^7f9JJrv4A=xshE?)~M!yhox?^JgF~D() zPWL)@SKZ3}qa<0KUpEpx6e6TxPYpDPuoLHHflK;l8;d_AV~@19 zl4hRP5{v|n)~k{cWkyQ^sjna7%XKf{{O>DrH_pf7kVj)!up>j6J~A)g-6O@oskdk# zZrcYF*>06Y{n6e<+U#6d14pRg?K4~NcWm8Y$^;$Z%$54R>TOnR;YsJ}BJyw|R58-mV)>JhE0dm8i zv*bAqTQmqkDJg#Y}gh0#?V(l%Xac=}HU>iNg8Dv(QMvL9$A~Ux| zZ}u-Lan->S(lrSV?kpzmSf7Ev)yK?JmTgxtlYbP8&S&$?F#FJj{o6@$498wuQ_#a< z)QEjzu)dZJ$!jQZ6j7(r!X-%Xg}6>m>~VBdo@@-Ksi%8`%Cv9(OJa!rB33(xllhDe zMc|=!oNv|HWau8OPm(_|5Bonpql&QLeE%8ALo@=Kik@*KKa1QM?_H#8+qm0|MYfip zbKH5P^Ys8XC;I#uZ?#T_Dwn93JO#qada%VL*qei>NDFd#-Xn2C#v?WRj}KxA_+AK^ zKH~_X<=hU8PIBd3*pg60>#&DLOyv=&dCkXhBKq+;ma_|xNEe@R|6Y46E-uFSk68Ix z2V`*K3Smyzio|-5o&3GYp`aEJI(FgX80T4$jLv+^mM#PrxtL2mH%;!66FboKfA3PP zL(9w>lOm%)6oZ$1`HzbFZUOYwz7p*UdxDA?{HK*Y8Re(9mwoq66!!lEYO702`w8to z@$g874A?0DSMl+8D;fWt{Qnut_WzLc^ZnL|2k*`Bu{+N&0>d3c?Q%lGS*&F&^U$HK1@MOj05 zS~fra6hxoddQ}B+-{=6Us~66VqG5bOd1MgO);zar1tgS|ln}=(PLGa{t;-f(4*0cW z%llN}0cyTuW5imj0b^8sYY4@f@SW=FGvfHjN%s6Q6LI?T*bY<%^a!`Y>w z@IR?3zTQXjg~%^|;hoMrPG{DbV|lrQAkbm4;qbZ?$J+Qj zG*%z0H9ucDV3remn{QpBOGKr~_3QUO9cN_lSs{1S^**oPy3O^*R4KHbjwT*G$37E9 zX0dV${c-RY^>@4J?Qskj62O=UcC$XBuePq7(bu{+sd~8%UR3xPdvHmxM#qeX(d%}r z-geQCV>L?A-grjr3!5_!?bPKK@c9vYW;Rl$-q_xf3BTp6?dSM{(R#zt8<=C`CEEFI zVB*igh1+-woO&u{IPSpmoXW*U-Iy)kDKqgZjK|SRd1Sa?7+Scy^ES)TxnRk{17sL< z>-=~msq(s>ST426cyelX2A$!jSSjt=4At|wqV-#$T6^pf+;zJN^wABB>CB`)JMoVdHGxT@>cZZAM-gchLn5dM+$?H$DZZq?lOiOR3c+yL_DA)GAu_%^HYpgJ#bQdPznZ zLvo%Xfu1wlF|0lJ=;SFS4yAr|h@ImZ1q$p^G+-&$+TMIvi3!Z2xN04t`}!|yeKUXb zZQ(p{wi%rTkP!W2M7R0K3ws8%RkQ!pmny3`8aE5GO%b`@sxu##OiUOjV0!Efr_egf zTa6OL3jb(*G#gtkA~iyts+oh{Bgc0*X7KYfGEM*4yP30cspoXhs9gIVtGHeHy5NMe zHAv~X+7i7(LcF#R3rxn~El$kNXMc?KIfoQ;Uc;aW*6`uwkkV=DqSuL)I`cin`dsrl za*(>C<2$3u5r4y1HB`VM{o9q#ARg2 z7cX8j1p7yZt9$D#oO>VlR&}9-j{E0?CZjc3IlfI>_xFYWLM$pT&LR-#jzhVk$}f$QQ8mF>A+jwayrO6p1Fi_K>) zi^FIV2`F$T;wKN3h?X8{wS2ZNTh&)6x;Av{mg9Y8JiqH9rmo81L<0$kTg2Gk%6Z^q>$3~B^?~JeA>!ohzdc@7RCM^xE5Sm>06hWOtt9rt zKayuX5iNIHYt`sOYa+hwk#}tE##=c1p)l+EZdrl!+te_fS@~+<??KF}mR=(AydMrt5iT*C(!Mn^Q&`-bWm{D(oJ(SCkNul2Kd#!BgRm7Y zqk`}-DDc(yq++X9&X*e9rky_-;k3{+n>^TzwLM<6j#Z{iP-&Ctc06ahP{gMF($<5(`h^V zuiPM=4q9dY^kzH1>;9aTCQ5bU9N*ClDScu5ut_7#udJ{4d)D^sRNHxx+pHAt6{lv^ zSLe0L9Vf+Q@K_N!h9NN8I(|}=4mChMhe-*$RLTA)qmL*6EW5U6NGDZfBtc>l2h-5h z+%fMgj=MCo$G%zPu7jjL8unYrsdSQ}E2uM4pw=_X+l*FtJ?u-UL8~kTm#XdI`oMz2 z-pu$eC~v%F3=h!o9Bwu{VdZw#>BS0iaj!BT0RY2k26m%me2s^gcLH~H&08O7bbASyk7*u4p|<#&J7d;kOFSDwW=%0D(Aw~Q_M!<1gjvBq z&l{oH2j!oaw-HecvAzyVT}H;dF0vkQ{-<=*kJitOf>dXVJHyrOH{qYB0R2KMBFhh} z3z|y>?VKS^dF;RkWoD*+=-Sf1a7&S0K6`FHb1^S@m}9GGyA*_P_>If(zM~nrRt3OnZrqc z^t92>Wlmwu!tvKak?`$MKKS`ugCu^|$r41@@VqmTBcPotfdgG}8(l;CRuLSwlZDf2ECU`laYRhvK zewxy6?=W=(NP!=gHzBW6SR}8&?zi=2iRi|m>OZT0$Luq@K>df_!6W6miTsEDqTv3& zD|EfjI`KHkT|8ufh)6!v(rr!6<&MTYQ)@Qp{5H0OdAPI5sJ(j6tD{0?q&}wMqK`!F z;5CvAcRd+Jy-z!BIJlR~35AYKnJ{lbJB{f}1`=fqhnI!rC*E^JC&WW9f@I4q`hg1K z(2o2Zlg{y-Tp27U1e$iQqnU>IVwgfv_3l#TN;T%!%prhY5>alI;EYg#t-}JL9;T=? zgNJLw@^}+?j_<^A!iWvQQL+D3vhrkEyqesgjtYZpF-Ml=p&LMuf~(|IiV5yt z)-1Ac4PX!G&*gQj-9ePxfTv6^9lV-+6Uo_d1-#-z9P)Ku&=G?LsWYLDPjfvR$QVl0 z$S^Sjx=jCQ+vo{Ahp)5g?6MMhNU?p_S|^x*^b^gysH#M9Yb3 z@d=dMupk{J{l44ggwxo)U;mWzgN=j_7^Wtn&Pkc28#Q<|SJ8Z6w%FQg{HabJgG-8U z>8pg%XY^evxvvZn{jAd~D-$I(EqI$A%?=Gki+t>o+k3lxzgCsKl7Y-$$?a_U@}H&^ z8PTONYK?+EU`Kx!k0-jH1?)x0qxDc0OR#h;q|5cDEfopPtsNtdU|935a<_0~nc`kLYH-j+ zZxbI1&J=NFrrLaE{X{!>iTNJnuM?=XQ;Hn@IbUXKZ}&$MRz9s{i$;w`4E{4-HEm;X zjRqoY?d|-$qte~0Q=}PFiWh;xQGUWjV`vgcJMOd>HW|RFwyBEGZL3$N(nroak`a;; zL!5VcZab>e+-w1!{El3)@UvzfvG2b9mt&!m@=lF)#Bh=Np-hd@9PMTg?3>r$lV!ZD zM-3QPZs9xl>=EQQS(&hpYIy$`hfi>vc~Cih^fPJHkKvV;{yO}@rJ0G!f&uH!Kq zrL6lWF-?81>0{H+%EQ~A`J5sbB{q6#zEGAFmzMR)#&0O%gV?rnvgo9lhB5h`v^x$O z*@7+urmbQ5Ty(5@8wm(HNz-lIePcol!-kQl(?c}_q!R$){ecV?@}fb7`4>T*QT;`P zOg7$)6u|v6bF8R?*&Z)mtOZ^~F($}F7=j#mkChg;%kbo!$=t!n6_Z)^|CZz)p$XA-THV)76F-fcr*I`e1~poggv1JQtCE z_V=wXzxyJTJ)c*;tC?UI8({$!9l|v-NU62SYFu-83W-FQF+ChD%5ZX|ido$;(b2@# z#HRVh$anK{x!OXr__Ay~F2>9pqeRIK50b@UQ^?}&<8vjfSk3v!Ke;yoPs|&sqVF^1 zdjGUED7!GF2yk-JFI4a|tA4M*i$0YA0%N9i{J{r^7djFj#FiS09R`L`>68+?WwhSr z`Z}D|Z69qSUV_ySc9nLMy{=}bPD-;(DUsl`m#!M1oNM17x-92!AosT@KFpZ7dvdLk zu$Gr-_VskN<5yr=TLU`~C!5V!(OlsDsLgLJYcXtef-%R5g#h>jfUyws({^u2{fhgu zID<9UI(sB8<})fmq+J!x82bi@ot{7GFn-6JJp8BOso+dyV-q2ti&WNXq(Wz%6<;8| z&R?Wr7IF${G0V4&Q_*kvK~5Jj)4830YbntKMJ{6hb~6A$1OS*ZNUu}750Px)!p5IN zf<@0z+)ek>Ua1L@JKM4cB0(D)x{T+HfMd*vSC!D&5FmUwRkE3W;y0z)xjDRZ{9JMA zppDtp7T@;4jZ11ZqI*nai`s)8K7sikUSR)w6NA}oy+CSF27DZI3eO-FNj47W>ztaF zb5E=FEc^Wb@UTXds2TMw)Ef?P9L_**5R7p|h>Nzb+#%{9Lewgi8wRr8Q1?4bT`3(7%5dny!!ovSEWj%I zwJdNxvzyD)yN9rwi8<0e2rTQ!4?%A152?gWU?~}}V%64Fdf%alHd;7wIJm6xIaLCi zMQ4}nndP|NLY{V^nYC1I2ayeUqTGJCPGAO2T4<(}@zgdJS z-P?8G!KM5{aqlc%f!a-&f7S}uz4nPKaNkzwNrrSHEO_B-;U+6VL+!bzlSXTOl~vD& zn7$3HFbbVVsytl8S(PQn1&D878&`c_3OSaPIU#Xw+Sd527WJT^Cu{$HF)Z}lQ<~%O z!6n$QLu&T;#z2oPShVjhKvHbA?tS`PaB~sz+FJzF*#UyJry`447n2bWmYdv}0F@+y z9eO?ZzYU`($-6M17m;1?#V{zS%WBcsSDQ}OkX5E2m?s=$wDVX~wX%kGEfEem0P zcg^=~AdzsvD$il^qOSu9=#V^8fuWv8EB3S>juoG3e&=F`MqA(ZMSfKg_;&1eA6uIy zv!ayS*A3V3=`1n1xHw&bGuuyhcb|XbVpHxj&%NYJDS^PgL3|swb)O@xp0}zQJ!)(y z&0fg#1k9ztXBjhl@t&{Jh!{`b+L2v)ML1jBiBn%yK)hV4iXogtWUy$SL`?m^vvCJF zgQsS;8vAd2?DuJvBPz+9SBL zu84-O?de9^TXzI!-Got*;jt_f0)=I>+Q8#VT*l_%;QsOrOcQcCLWSDRiH9gt#(%c- z=tx{*R(y+Ip%cv`{k@&mmVp#H=oDn9$r2mkg^G!v%*1m_0?8A;;Bf^)R|!`Qui`+A z;ig_luuIN$X!pB+V(d#*M6F@gbVl}fb@-w?I}?T|!W@4rY+}CeDn{IT3bLD%Opt~d z;4|rF8IDV4h?6~!Q7MNS$QegAiRa*Fe zTZ^X(kKbI#AinyJgnWm*RcIu2Z#N);CcSB-Nufv@Hvq zHZ<uwbx_ zbmirjy6w$)qeR>QcrL-;W5{AT$=IMcQZpXUYyZ9-9K0rRv_lAut+u;Jgh6*2LjcSUd_erdYQ9>8&@ z<$@0|83l`fnJ{&HC|@w>{?KpNn44ew)zH>)f)6^A;WO077j3*PZTH*b6N7-FRM5}a zT(W9R6jT63mizJj^tL0{*B_*+QpRIF8?H>c;Kh{6CfnQ(8w;h0HbX_8NtvDiO}dX~ z<{Z}~)n_QKobSTPu9?|d5;`6av7JTqKn?jZSrr3}1Gzui+!bwbS#e`}A^<6o)+?bc zqwadYiz~&FKw5DIl`0u#C6S|%ZYadnci6yUeKAY^$ysg9v!U-0opi`A58ZAqkjM(F ziKMO5`N1avQMNkAFS6ZeTm>gQldh|AJgK==9g5kRI%;L-Zr_&}#M+BT)Tmj1P83aO zuw#jum`_Bhy{ar_goO>SpwntD<>EzGTzFb@OUr&4nv7SUQ*s&j$&@ALRTj?1&3V^f zis{Y0bR*Us@J%falPRu9e1FC=&?aQc<*lj~)xeGH6;sEI_+?V_rrBusXS zBEo8ox`ASH+KtFY?B`jeH9K+$o47!LE@+WM`#nZDJ%BkCU2Ir@2_(PdAd9e)_U_&J zN7o$}tA8twcRIaQQMQ18=qCyM|5gL-|30<=pDRv$SaiE%T z$wcD}C(*;@x0eZJb1LtQ3HXfY2wfIt)0xYP<%)T8R%Y1|iFHwk`RGS2Wq{9G zjNKu9tQ+ZDc?@~0!UZ^naT#{&8!Pm#619~~!>!R1!_EJ&&@mqKMQSzHkpbh(;iERrTUrDbW2)pzHA;gTU)n=AF{T7Z zJix1&b8Q8;)PLotne{X3zF>+r0}hB^7QPt(wfHm7;- zjUr(atDD35NK|J+A+DOL%ke<`P*Kqoxgury_b!&Z1>tDm`gG}G3C-u^N3nyCg~5vA zXdmPw_QzvhgmUa6c#BJB&Q^L)dpAdvn8Jhq2Crk$Z+~u@Dx3d33cXAGv#gCO5%70} zJlKgm4=WsUqCYGDK=n555YsBxk26%|PTQf>=xosE)MM8ruQQu2in`U+?95DSsziT< zg;uw*B7hw`u5>!d}MVeZ!8Svxyo}c@pbfkc>%;EO}UtB{D!@PpZ z_V!``Z?CoTv?Wd2MLP>`rfi~WDYsEtD4=+w6YfzY1K3;D%yj4fbb3311wR6d&dnRM zFfp+>StauB9SaD!Q_DjIa=EJ}Nl^MEqJQHq5E$s0XhFlkFmmF$F@c-S(p`Lg?F<^F z;^JR6z!mVk{{4f7j)6g_HA&NLeH5eh_I8@SrX=qVC_5W0E28586!hJkQ74dJe>nmF z4;P@8t}C%qZ8sE2L_o`n)JpPnU%2(0<6C2^I^w}^dAj!C-AfJUVs=fV(>JD}eo#lTaxPf;u2mSMWYZ`E2JQE5ME^+^g-@r?q>J;Pt>GS&1G}P%sLEe#5WJ`Ynt(Lms`l z{*mZSSo+{*=!uu>abB^|{o|n$?@Aeg`NEP%EtinRd$jWjwpzW_TFPz2LR;JFhG`;^o4(F^T;>HuY1m%FS*Z;Q zTpZ)zYC3U`i>Z>Pl(+WY-L#qnFE71u;RdrKvi4k!ZE0@tZYo_~EZxr#`E-`H5Q4fx z|Fpl|J1Cfhyw0`qI}BJ83ohmNt&v zrzZXRsN-Oa?kF{>wx7es=!z*({hj>WmGW+J>xgx(hf$XmQfIOhwWfK0RP)OT{$M?}?s-RmgcTDT(ct3RS`p4A0+xmHq$&1&(k9Xh*JYTmXs1=j<1q^vgE%Dl2 zISy^CuSWKC_#Wm{J{ygXEIXan^JaC^P4%gtu@e+e0N%^sf|*1*jq*GX-Vv+O#@uVO z?tMPH%(s5T{@C{G){I11Oc%gypkL;hpA;l#U*PgNb?L}@zhSPC;;{|9_6SvTU~VzO zNiFmmWZm!j-Y0KkqL77_m7pXvUQ9{w5-NEy9l9)Yo!HsJ_S=qrCG= z3$yE88NaR$wV69*kY;nS(V7E{=HYwVxMFZV3^pIxZYxrs$}P?6|KaBHUImVQ1{{L9Y|vJ ziPw$9>D3rjuHe(_U0Zl3%1H%_mgj2bpsZ7;mc(1T|I*b{Lwcg`i=#*1or_ob@ESs9 z|Iq~*36cdZ#CQ8jsePJ-WN_;SHa)p31}%ttuI-Vq#Un898=6q9W3laAVk^pktS=N0 z@Xqh1y4CITTm^v5*30pZ$#bdcbFqWVVrMTf$Jbr8onfjZ;`Q{z3ure(q-702a6|WGp_XZ2wHsW+ z-5pA)^fMPo;PjJ;xL8McF&FDp<`4Q%Ea4I|B$MU!WGvFkDU->7eS1_i>Sxc~%umG& zA-QF7M_7fN^1O*+RmpA)XE2)TgS`u=G~IDWJz$Z6gSc4X3n6K#FuV3y>L{I`FHMXz zKmd(1J{a6~svFJUhF6waZ_o;Tx|gYi3+~!<>RwhQJ0Y3wMznP)iq`|V=0LF}FR-}< z13d&JU?q))xjy_>kXUCVuQP~J{*qs?3*H-a7a-0i;CDU74R*AJ^z})m4s-6fysLVh z1%RyzSAMsA<9NV+ToPIp1HZz2UaCO2ESuuBmVDM}fv!i~v_D<=jA7JCtkmx6k5Qq5 z%x&En>NCTD>TmL#K(dpnC90^ct^RDpfMGT-s|1PpalsUxZ&9s}lM|p#E}O z%0PFT!mIaGy)boAFthG!^&A$C(6j!n9%+uYLcOodWzTpf65{X%%eL`+f^>)J_akBN zB!VuD(k(MHoH4&wms7YiuJ)SOb3DH61v=<~u1o-A_G8&TNPhs*S$0C)4^qax*74FHVH0LfG{sn@PLmuNC`E5mJ`ld^u|cdK8%a zQb&SJbCOv&3}>CBvJ4{Rv3kYbvwqf9){hXgy5w9d9EojWq&FE1!FYzrs5O!hjX}|+ znRL8Eo=zi2sDnjvmSIv*by8|7U>IOKb)Dfqpo5Beo~8u5F#s5DgwdAMI@X8tIgubR zwD;`Qg<~gu(6Oz7u%(M8>IEuZOXJR$wiKT;8t$EGexv4Kg`M^AnhTQmwZD$r0H~UR zweB)Xdb8KeOH{cudK;3^Se3#dS%j85b*<&#fVyFA`4W}3rX`Yy7^7b$)Kgk&jk6q0 zTU+Oa_k}1C;bj0c$q7}#_S3eKL9PgOHocj*ULD|6#V0dsCJ^6_jl{(tO%oH!Y`U$h zK%H8*!|Br3*L5+F^NO8t1JtB%6Kov@RA_MI@ZMaZn!AY%-ybDBcHtAujEQ>b`D=-v z*R$$!#O;QZ;|@F`$afeSNMmnPC@Vb)Ts!en?YQM0rUHm5S|pwS{moT8RYG99aC318 zj_K$NPdCGJ%@K~r{Z3f1c~JuMmf;$l-&`ryy4Q5fPcdXX3~yizub4<*W-dbWar-x+){KJJO{onr9c=8~+guh*xrr5AMLE@SRs}>C zBYR0o_J}KDMu-?>10om-eQfmsZRf!q?6MC*gp)g-izm|aPMwj5ZPbvtWjWdv1gSGg z+|5S0#K0H(Hq~c*PfEys?wh|G;v*c>kw$Y=+a9-TG}>ZY*JP3}9{d-YmT6k9qE=0j z*d_vtFfswUH3Cc+@l2?hyq>pOTh*zbl6RLq8x%~TXvIjwofVg8l$T^x44=W2|)z&`owaix47T4|0)so z4TL5Hz-2*7xkQZ6RFU4jtFurGU@u=d+;uN8FEf5yAL!JY$mr-SKQJ$x-2UpsLreEj z?PPR+J)mVy&*xpQ zGycxPI%9F}7mtyfFKwv&b&A}`Dn9LaJBiBlm0 z;wA1{i0=8&cI|UU7Y(UGZ=-O~bPH|8szDhtM9L&4blE8U#`RCBT?$1ERBVZE6JWqb z-Ii+fTiMDrIuzX#;tbn376?pIZoG19y&JFdg*qBePUn|4v7-1~&2yjhti@Ch*X^(h zzuacC#^aF()Dg&HPijLS=Q~#Ff#r!|dr7ipaqlFGc{TS6z8p+FElAnk-b~DnhPrV- zs0W!jSh~!vV^D8g8oJK_ZV#O;XDoy+G`U-R2e(AX*#k%^$W|8Wj(+(||J-PI0l}3> z$ked&^PODY8CA$*xva@F*p#)_62#1Tw>8%*hc>@`TnbV+R+~&@(+G%~-syT(SUu*t zr(a#<9bb-}NSMSPa&8qmqK?=jJhfum%GGF!k~=y+V}GLGUdevFatd5dGoAZIQ9Z*A zhh78Jb(%Wg#uGQwS9K#Xx;RLpX|qiRw1O_sc|dnuw5BpJtWgFSwC*O%8%Ac%-O697 zimNoTR?&AsWf|64$*1>)0s>|e3LA{S6%f}0wM%vTCv6C_HDThS`n8=fJ<`Z(4os3UNc@p_Tv`^&dKp3Kt!KyXSt( z+@9Ttya4CmDJNpxm-W`CSI?6TUv@#d@EjlLr4$wh6E6|_Zd9NCZI=szF%3u3&2Vw3 zzUO77l@!wmWfi`NOeYojYa79*CEpk@bE1AFuS+i%SNW6^Qpcd}iB*;L+Fha8vKdkP z(0J1k%Z0F4^Zu_9cR=E2&Q(*H4IFXCS9PETU3N7(_Ug}7t=AoqP0LX$ z>`ZWYxW)lN(32hi`L8VEZI?J|bP6&R& zZZaE9D|wQ=l@B1}Bj#Jd=2gG?UE!%jj{zV5d1vxF(*Mc)&kef)Gjcgkd-@5q6C(PY zAOINpVuy~gLtqCMTU+@*%DwE3;AT2;}4H$p(;C^Gz9=OYvfgv&MD`{l}WmitZ5 z?dOOyy!biiY2ojhi=rnha~UCx7tfuj#*iF~3%6e+1*P<^CpXP@ZI=b1^{6ifXxzO` zs)=_SZFxK#Rs#($D6hx8Hm#QbJUipfvx%0RO0=g4FeprZk?w8zYiG>hEo-|HR4kK< zr6n$%u=YrN%zan_)b(yS-DDnQ9W$xzi`L_lzwryY8N}%f33yx4k#lF(a;@)$tH_85@@uIk&&ZZZBDgY)0X#Nm>_u%N-CGrW7Pz*-c%` zI_~!v54PkK|8B-CR7z?Wd2d(8u~aw^$d+qsf=s~WR zk|!4Yn|(F+#LG?4YYap0Ohug{#Jy5)TCaje7hNLen*n~2ZjIs6>(vj%1y2$|BL8&k zT>&41F+V$>bDOgyG1B+%)-U7#4{>i9)m9t5eNtLVad)=@#oeK}yL)lh;MziQDDGC= z-Q5WiptuKj4elA9ch-N+=UMB0XYw(*S60qB`_4K0+SmT=vN_#H5|i91ZU0T{yD{%+ zK?q!+38J3!vk>ssm>X+sqznssHviMk`PH)>D-{fR5Ec^Ubd z*3GI=arAUG+_CYqkpN~>fK|VbfU>&TlT&NnqK1BNy8p-|Pe9@L+2U$hN#8fXcXg`i z_2X>12&dic%pIkbB7N#ue%QpOW|uZmqGzkk1Ld~`OHUG^vQ8Td>JSPk>el#I&=)|3 z!Eo2fg@1vvg~Yq=`E1F?J3!DBEC9Wx=lDgIjXi*978m%#?4@L1iWG;t)%%%N8GIA2 zRFwV}M4?%c+JGl;*(HPBYeiKmU%kY^KfX#vDi={#JoYG@03+&n#s1LgQQzPQY;Fnk zTNQbl|Bt)TP1Qh@wYA24pO^i7a(wcjt40_rD`gTV+3;{m7z;_O-$xU9omf~D=`}cy zG8Ctq`(Kj(;T6NeUcWFDv1V~42-)`&Fzix~=Jh*EVXNCxI;*rPcp-pQftk19b+%hJTe2 zi7!TwWr68Rg@;m6B{lD2M zFbXK2pZ=@#{2xT6{C`pDsia^lWE(}KPaXIhAHQfqGGqOeIrljePZjQH(NZ3NWZE$B zs_+BV{@zz(0iLhKZBOs5$BP}X;|-tK_*~1vhyKRL!2@(c8x={`ZNof4+}8Q{-j>ni z{XGb&<0dm6iyn50OKk+7WFSFx~)Z@NUdc&_OX_Z3w zzq{p`>K3Q{>Io%K%CbM@>oBI)a&;7CzPDeB=Cg0^qfoSKS=lsRer!6B#wfx~k|%iU zr@x=O%a}a>q$pS;Ls5WE#P43N8sU^RIGLp%Hz_sn+T<%>Pbn!{mWFGuUCBhN%%!A7 z^xuU}Lup9nE0EX)F?~x$dNsk?clIi?7Y!0r63g8GOy8MyTD0s+KokqQEFG6GW~Kb? zQY5)-vo`IOFc>+-NT-}4v7LEoiW)6ZP$$6_Y0);S+Bls&XpvI#-ZnF0zqBRB>1ZFV z!CHrG6gI(cehWp>C0Q!8$akfIoW=tU@+7_^31_aBA5p*(X2?+DqrA!x`vv$lEXB=i z#`en~M`-loS2483VN@E`nh+UTBL)v8%c>)pwrX(l5!NM4_se1~_2oN8e#fBwtDF@H zoY)sNy>}Q`I>cU;anK=W{jcY$+pHmxuONK4jNV=l>}dBa5n&p{90UA*U$MdqGT37;;Qv{28R8zq)kM{v*#CHX=?Qbm6LM%^3>A zvPs}jJM`{GS*etX>BWnyZImdE?EixUh)BSn%ZOi6po{&BZW4#IwPjT(ftja8IGj4p zF=wc|;Y5Le7+H^H9p0Drt=2+P=7oZuv``HnJ4K`4ft_el`ILjxht{~F9X0Gx{r21y*=f59y__b$j7X_M3aV8z!EJmNa?J1|CPt?vZxp_$5X zQlg6gf(e!=ntmB22gTgSUa~0yL*4rb!1@9*eDKP={*BQ6CFxRjq`gm=TiTQb2$@az%VPpxqgpn*me$?zZ1w z@Wc<5+iW<4-`4X1G-{Lw`~R#blu}!ao#Z1;*gmOYOt5z2FV%hw!E*Tq7Gd~td(6~_ zBpVU;aP7RLvJp3M#(tBIMcIlSuYq2z9ZSTy-*oFKL?k7*CB76aasFOL7JnkO&<_?trw;0jT64f8HG5>qrQQ+U z4GQ5&DwKaIibRj3qFttX_w-p^Ux?KUrpUCVCqI2Zj*|MVIQUUY%;Ts%#A1)_4Xmms zk?@nN*N~*}(TJx=TI5=G@$szIYGu}nVPBZ-I z;^d~}@5lGvQnB1d-dl8{$wiK*;emF=+p_L8{xzO69Ltt3?_cU-lBKTug{{^3R1XRMrmH;wL(l4t1) z766%e{0JZ3e$r;QZ~k*~b{)$nkEQ_Of8y8Eo4~4GDwK!}c{|s>sGY#YuMhRCaD|-J z4Z1qkOrkRugy=qV?ql<%f-ccwIILmU6R1PUDV(!Q#!Wonj)Mk&G~j#j6~g{mu*^`w z*$2NHQVHpU8DzsX7a68bRtu$N%%gjs?3?3nr+FC((+6XKSiU6tb?Ndft~Twy?)@4V z(ft1_kY^d!4?rjXas+L(XsNB_LJSaTvLqqAq3zGUT-7$<%s%(xf;*ytL;p$ZzH>lm zy1rcna=|^HS=?mL6hZOHnYBv<4Xo&Ik)!=Of=l*BThNZL9x$3uoOAp!c+Y0dtFDJg zZM6})rkRW34c8`%te39)sl^gM zedtfIimnxHcp;5JK!OB!7y;=HlG%UDLs@et9M5J;GeN_s*-yM|G>p-cyNUE}nHDe< zQ<7B7@#1nEadM`dM4VtMHARdCM3+o$GcTmyCWoo;{Mf2Wy`p!BJ*{x&u%Dh~FL z_lgc#J;$d}Sv6g3T|&wIdJ_-<%nv<~R?SniwEOTZxXjUdfo%ENw+4vgg#cI$op_y9 zm}tCzpZjI4_Nkj`lnZDU+bWXDD)zWwG@a*tjWe z*3t3vwA_^CuJy|&&b}`<2;E0L=n<)#BMC4nDMM3m;bZ!<^$UqvM@Q%7zNhDIPF-13 zTbt_rlpu$Mgs^m89!QgVznfNc?UhF~zI~h^M&!!sBRpcH%eXJNDnb*wR*#QUmV$wC z_LhJhYg()gHF(sh7oXn<4IdO-59aGsHzHHf;Jj#FJs(6tHsFo^2=lY7Z2lPfa?nMa z<0V%zTQ>iVQ^1lJfIAs8@XQw9!vlcCZoHm2N&Kh$&#^$YdjeO_j98|7B1}*-+dS*} zAYjmX2O6V(^M780=#`#8Xn#nNQVG^XP&z0pegye51N&vG-(D_RyAU&`t0m0ObX+{e z1s&`z5?=_A8Z)F7nvRCVe<1P(+244(;~9BRrz{NsfNPcj$U~~}`S*q&UxE9%UAgHp zS_ujGITLz_M?hEW?k$h@Pb8|26dwtZtw7mTI_*k#e8X*Jj z9ZR>B-q8DzRD_-am7ntiOaqOu)*ucw9BJYR=U)W6nG#_4NsR8l|A_x>bW8Tc9`s8RhH{5e05#&zvN#zNb9MwMUdXqa#RG^JBybuh1baW~hcCpIOHbCw_)v=l2G0(%9fBt4 z9B6BcnK~{mf^6APR#o+GT-sRafx;l7Xn%K>aJ z8jaE$%K4?(Cm3Ed(nQs=ya3o>yaWl#j`bY$*eMAEWvR*z@@3t$ZG|Woc{ox;0^Kf? ziS@ZerkgXM&V07pr(PV#<$4;YPKff&$KbF$I5+?jBG~J)Px|h3IZW((DZG`!y1tP6 zg%pP`rH+=MjfaO%&90Q=Zf?Jf!EbW!&)=QBCXo#(F7ti5NU_V$4K3-%-41B@Enq#D z(m0np6kmF}hKZZw1-+Ij{6AOwp$T4M-Fyta2nhdVmAC4lej4*~cf$J`>v?}8a_2Y~ z=U||^j;)GMaIsMMw^r8%!(aH~FgNy4Oz0ka;>$*>d(LXg1>(u-2MVSnUk=(Y%lY3- z4Rb~O_d`0OO{m9eME>wB1G7U`P27u!9X zm!lF9`GUOvDk>+}7k&XZ8bWm|BrHAc!CuZc6J)Yh)~}n91uEu$$!h;CzoJiMH8r(N z60}R&O^-Yru4LsY!smnEv|h$f;N2`E{jTv;z!*os@3M8>!?il2{Bhv4!{`Y{fm3GkRGL&ASv1{m5P{UO>Yr>l*xw!}plr@MgDqUv z?=Iin{Fy^XyhseHWML4G?v(xR3+;x_>mRq@H_3smCw0p024B#ca7C`q?L<gEjKo>TkNXQ1A;fDHP(1O7z^>@ho(ut@fZc zR@(ZKa9yq2Bt{`#?!eOHsq*~Vh$-p;^~H=#Z+Ls_-hlR$3>cJK2}isZ{|UPX8DyII zLF07FiUR!A=-`Ac`|D{P2H^%*xT`xWWA zd;DXy$2kX%6ZGIU_)JJjAucH)6_2)ea*o($W@T!^w31I_J|@N(w9@%H(Bi>$Z_Os^ zBWEc%P^v|`{Ica62ETr=4{0PWqg^o5)+A9iJ8;TiVKGptg@NiPq=MRDDLL5r6wpWi z;CcnL&^XqI%3$miPy4q;Oa?+@g|mdb8-%?cHUgg|B1F(rgs!e}BD{>g)n9h!V#O28 zTtHWQy5C4CIfxC@=&1iBKlx9syYIyE2tTEkXj@ICCkkEsV(HGk`l)ij799avu&gcn zHHz(GX<`ctKYMqRv-AX6_0=@X!1D1k0>eV_0%eV;IhN%3WOa)|=uKPl_BIckoa{KL zzJF=^im7b(x>pl8bKK|_c|S^4M!G_so5^cH*V3(cdoDO+%(eKCN;0GAEiPO$Z~&;A zhqBOuuPohPu^9$;vZpoDr=S~Yjk@^L{(L5PM};$fqH4w_Zz$eVLP9N7tk7JZ!we}c z508_?NrF&v*N>?aYcBcuvk~|%C!`(T0dpgZ8xEf2o%4d3tNo4e_e~S)_}(7$Eu!9+ z*l+AY{_ELqYiR{$tATIc=uQgCW&6y8=@DX5$NN<4A@a2ugiQG==-k5Jcc}3y^)d$~ zwLibujqU(s%xC6MFtYax)TS>S2{ITwrD|mtM$s69!;GQVz!0bPEINa$r2&SH?lJFe zOFqi&{GP5CO*|ooJ+q!xCsmL9XnD`$WZLeRMF!|o`MhhM*i0c@3-qOqOVY-bf@Eua zo+JQj%o6Bo%If;&#M9%Ri0t0wx#++$=MwO;sQl)Mpxtv3ff5^d#z^da6l@%rc6qXq z^0t`wO3u4dsww3+Q7?uQ>#SF1-U9#Srjl ztqk5_wQZ`%*yUo3yw{JMF;3Zzwu5BHOmmIa(ymE6UE=v2<4s#`PMM+fJGrU^){e^f zL@xc$xy8C@o1#&x!mN98A1Pv-Ks^Om!O@qLu-`W3R8=mOM!!enc-+x!EV(N&PSM=h zJW&aKnd-IZV=Nb?dV`kEnfJ9_2q*IuhnUJBC6dq*qG`I-Y-SmPoI|bQ2detpVp@J`!_M(7^GJk1$oy-s_mKYI0p^MjPGZU@w<7-53rFZO$tt2~E z2y?EJMP7xH`02?UN<47a{~UK9NP$+kZnys=0Q!XKLvC^V zw9%tB9`JIi5A9G37xB!vwQN^0@&Fn)%!b?xKLwmW5v6CHLqO9!pG)&jS5j1R&vAjptzaeQC8|rX%hOLc+;S2jq}Z(nVGk`mCFN6iHZA z!t+Z0_KOi7rw;Gfs-n|XkH5o|%m&vxf^0*7*?855SE(wqup&ns3pV!svJzWq~HwnEQMb+BfE`gOv92&6sjvg*; zsOP*+*@-tOmPSA4ULHx~0iA#K^_MZ94Iyg&v|kv{{7>x@ip{VxRY-Q`W+uM}VXkk- z65>s)t3XRtEhH0_odfpAzDnsE7JG|Gg+*!LwRYgs;}oPvTf|mafSX#d&Clp7P~}!p zytaE3VRAxruQ16HLYz&DcIP$d?R~U%t@I+*!Ihd+@h>exQC8UkuI|GQmxTF#<@0J4%{3z4+N~%ODWxltQ#)TwwG&_7VD7)YkO(ndy+8kY zeliLf;-=>${$w$8p zO`D^Gd(l#xw`6MigkB$~JnW3rlh8>S*#XV=0k07oJuM_6sRdsmQ_Lk|aw8(M%O0QJ z>+WYOi!!@+G2g0&fVhBBub>{wjXWn*ZUQ)$10^m#-IEL51{1|^5Q1b}Fr+slhG7@G zlShk7;-*opHirtH+v&;gM3g4}b-ujm4ynauBlVvx75&}Q(j_+{eX`OmiQNI?IOmWg zzk^c!g2G;yuRSwnPWF}8D}5o`dVC?$LE^9nd;WL4t%t_t-!7f%5>`7#S5CZ)I-ER@ zgv{Suq>`{=CWb|8KQn&}VTjr$Z&F=dsANit*sCCI&AFbg#u|ojY#pQ`*&2c8RRE5W z3cb8#?whoO3zQ!+Wr}WZFqw+JGYb2HWi6-=EM%04)zu4&B-QrgBUZbE+POG(46kSG zu@mltP%ykfc&>ztneB7QHPF}bpdO6%LvjY}m$@Xi;g(q>Au1(D_R*hc;+tE zcZrUN>(@GVum3UmA1%N{aG}xPw*wB)IzTy2=FQt(R8>&WQk3Vt@hpeqF?IG!f+TUW z@K4q+wbE07{*d6v+VyS9N3P+^8=A#bIe3O<;*&wvXGw|ljV2Yu$xe^EUI2EvnGN%u zh^Nu>ax)Zlc|;*2R^g6sjXElL(8Oz?Kb)23-xpNZ-S`FJT>#Y;=T*Xvcz!Js$j3$~ z*7^z#h{DkEGXKHZCJjPU!M+N1(zx)s7I#m?i2G#- z2IFjmeIYfpfX6dCW=aaRD-`U%+H6)1#=T`F?V)9&AMfv3|HW3h^kbsC>ocm$N5XfK zzOak`{ouT-g$n@zMqdj7e(M;H6^%4u_w*lR4>vS!jizNdQ{DQtJWWqRMawFz(SIRc z;mN9Avgs~aIhM&(b57TUVnt@C0Wx*-+i1AO<(__!jbY&wEUK-N60cxs8sA%7+sMJ0 zeA8j1Yz_8lc2t#0a4X(#{~ol1p}*r?8UC5PuBU!GM%US|2WwGSxSxb%IcOH?t(oI2sp*1c=n_QO-WCSw^4 z>)bSPeeI{d=GP}4u*iKSrsvNf zhY24pwcPN4jq^sIlZJa%&rHqh9QozPQu>q`r8rcYB{CL;ZQ z&g04TwA1js|5ReSGK?kB&>LUOsMFLaNM)*^G_kC%KD!h64x7r##2YF!0_|@j)lAq0 z_U!M9K-U;kW(cU5kifIv)~QfZV(dTUWzI+CaH<+nSFk6PE1cdykG*Pb@U{#U1UdU- zNF%x}nSa4fi(EogjUP#NDl6l5>xr*!*|bMuOwc_&HjRFBE_PCpF02FPlnI-R`EFA7 zyC>QWVffbG2WZI7XTgc%QB5|>vy~83mr5F)&U#1hCLeS`#9@2Bl6g=q1ce*=7^oI4 zTr4rsb362CW>i?uky70Uoz#y^sJ;8uqijG#<^4JkXe@F?y@Z@M&hZ47V=0auV&K4i z7n>V9gKRYOfTMkq3VnGgZgET)ck;12@GAmK;>lSUw6`5E$Dp~L&>B0|UIpJX;0b9C zGx;2!W%KABvZu!>t)=a3>zqS91)!nhsbk>;m7>Sf8m(&q>gxy3Dp25n_ev z-1@1{JB?rc!6Q4-ng?>4Zr4$g1r13XFF^8DBvlGG(Vs$BjupF$!k7XH!Ty)d&liq| zC2^_;1jEB>{_fgd)WB@|hE;=IA|&{ay37ev2ashpE%3JF_%u!W4H(-5Pls`dxZs{n zK!h}Nn;wRI@WqPkc}m~=9X@$OM9Gge?>>FnEKh78==G2+O$Pm2FB#j)-X^FjwYYfp zylZ@stD;CE+NLM+HeeR`TyJzSh&MpRQBr<>Eh6}KdSLiAWN@6)-rH2*#Tt4rbHn7m z{!4ha`pGAJ0_Ka03FAWa>#3kNtE+DU4Uhfn>a3p|f}c^S3sTEH#V(P}zR?=J{|`ty z^ijEAy<*-*tpi9TRS=!E#0^-QYlXVnAfdyM;}gcX7OnZiO^J3G;Nh*kY~z;e%3ens;)XM`NXG7FGFUGyXDa1-To>NK?wq30%eC3G*V8LaMQgg$? zDD>|@@);z);NH5Copmq%jtams^v)o)4#$+33@#yUOoe@Q3ay4VYDN7 zHeN(-KH~CskhL!+_@vnkCmB*(vCL10Lr=u1)%yjg6)tXw(+0CmN(Q0a7>s9bUkKhWTklO=Yhd5+yZ0!L+jf)^WD9 zdz;!3fsQu#`mS4trp5NW0gVIa*tjtZ5F1ihrm!dN#Vt-ArfQ%MPxOEv1x)%zZ_7JQ z+Nk74YSUMyY)FA!7WNX>rG7`sESiM>_G-(zU+>3bMP9BuF5YHSl%Cs;ivJk0yh3O_ zp)a(tJ#D_HZtr!1cq%N{RGe>^IvjTm>71gjx*o)V_SF0C$DD-O0L#G3Y>@H@v;6)n zEYaQ|?*88X7lIK7O}o!wY%lJUOW|=83Ji(^#@&@n^+Q+vYcCc+6xX?6W1euQD z+v^xJBH^u~_N6Aqic7J#)@bg9+L<|A?FX!coAwIU&u5IgA3!WoXB}@{*8;NWu+EzA zB~T0v3B=UPw1y?Ir!}drfPY;2A`gG0E%`>{)5^~p!S5pr;2Wh@EA7Wl+zC4bRx`qe zL((||PKgo9dW!Z{#>r{)azMYxsNgnDf6pPrv|W3_kF^J+pKX@yl<&D9?3fa&51a&o zr6(|Nw78LLw^KLTx|bR+HpsFM#kccsJ=fY~hQ-c*sc+bCxF09Y$RroCth5FwrjT1} z{PwhadlXq3E?Fq)fViJG4k6fo{G1qr+2Z%=KaQp2IA5I#J~4b75eKw=S=N8Mj*Trn z$z2{1x_!!AEvv|BXNfw{Itw^D+mR&-Y!goBa#>FaWzv6Bl(6(Jv4ULY6x=q!La7?tr)K`U5=Bw?pTG&pXA*VDF9cHnH+5 zi}4019~NE=3UZnQo$d56%A%DE&>@mAnTrQ8UFnQeTV4n#kUn%jp^V2qeOs~5ZC_^3 zRx-6m3DfH~y%g`qIVb!*Vn^DQlY6!`E%ck*q|7BMpAIF)tl5kk7n&N@9%ROuQ*cRp zqo~OTJ)$oaC?WqqT)bGlc*l94Ni14G*{RP#^=oc+&6Hy6M1f-U)ckXz6a>{SBbhLf zHku?mhoqWs*~D!Ng^Mo2N`tE%pUwPLvQ_{Fm?1H(Qd8Sk2`TXlt+4p{ilWzH4%}eCM*Nk^M2$Du zJ#?lYkex-X}mt$Cpi zb~U#y5GZV7j+$C_!oPkLBO@=zyqP{0MevzXSs z=w%d8HGS*b)}^+s3T1Z~7f>q>#5%+ersLK(Z=BZ6cm!lIKQkdu=%t|ltWf&mZkM4~ z&R;e>Dw1WCGguC4a|tSJE7BE|uR+L7C(t%9 zN+BKEk+fiH_h3Fz81D^{Hc-`_**SxnoaXw6Q zbO4lf1pdg4&oJWm6f^hua1P$#dMdPAWRd%WJGRekoM3Ke1Gzs|qaj$t+aVDB#=>l9 zt&XBl5Il3%yowHJw8s91w5)KadrI+nvs`>nX4z=x@B9{Lu8YbL?EWB!PVSVY%GMEU zrbX?>F=XYYODc1~_LR(Zy5Hsjls56NqGf5#F;ljJ^T!tPaLCjzf70>IpQux{kMG?h zVWY*$-QoI+CG2%rh%@GH;>s<1FT4>FMPVFWDFFklq0F%Kf@)$d9(Oh|sHyX%N6iUT zZEr?~HU26>;XpH^`&zKOrwud~9#}MF+EoWP_q%#I< zUWjPjz8zu<&l@9uiyA;YrA+?P;ru48p3h!3B1kx7;z(pF$wA@pxwnzcD_*eXwsAhj zFU{m1Md}ycZxt?Uj7BX;*Ph$nUHGBiYrjy1YS2_iB{s$KA$yQ%OlDg21wQxLNI9uR z*-D)FQFW%BX4@)Z`i+^ReD~F7Au}Pj9&&& zO)1soLhuHn_=JAtZ$+?Re#rIsmHc>_ofj+RQpn2Qe|nzYb@kzAg?{NLD@T7I1UG8< zZGkFGn)ax|XOSAH7>HAx!lX}FI?f|}U8*1>)UY>|$>L5Y7!qzNmBHCE5fdXNu^)OS zK%^r({Y2HFSAPyd#LQJq#9iY_g&bF0bWQqhPM=^g|3l!bNB9;s6wkPJ3CbogJ7{V8 zE8n{v;eEbu)YX9>Yv8c2B(#kq?)5%Zm z(d-#+36CJR*<=xSy-_}v^RBBZCLCIXR6Y@*a!UUIvWHJ}QpFiJT*Q>$0vMGlB_kpE zwAzM<)$lKtD>dqk4{Pcx=xBC5*zAB7@Q>!QHFTZYgg4u~SDc+aTT%L46#0qsLs~cb zC}+nlie^{m3@!BW-V+Rgc6s@d9+#eS8qdk0YsTe}l1-Sc@GEm78yp)_mx8P*2(49@ z!{y=2J#uG02hphy@aPkMvODj%&%0G+()UpExM0_snUN;TxBzz@-L99{9aKsXf*clB zVQ1+WN$XMYUzmhB+8JXPuO{w32Sd4@zgxAuCHPW?97WBjj=O9xP!vy6G0}Oew!?gY zDGrf{jjLbtSERis7CDDjl<|;vhbwlJCU3SeG%W8rn_+vneY#dN;~=y2r2L%P3W^7% z$USWR8qOF?1WGMwj*n>gAdIwb&DVw*au3PcnV5*bZmyU4;9cdp_NZ{k5&i#t;0 zpJ#Ko`%ishG8s}K_-~K&$lS3Wqn?;9D7F*fROF5%VirK>cvU+W@^|w}h}8bO70$-i z8=yUuJwbwyIG*rN8t4m(D(=EG8osKhs(H_VI=l@`8o$#KuXD8+HXP)}o)UNuGqoQq zj+Yo=@c2)ZS3>=+4~(7a>da+b{3w6dyPvMifI8m5@01NL$N3C(r+~(yU#+ejOIMXQ znz7)6fTIm3Xr}u`Qvp`lG+=xiwfnV#7HnB8@=yX_KUVM2C6P4t-gPk(c3u#0lbcHR zmI>!Fa9t0;-ta5kughT@;MVKwKN6x%c;2)IH{n5;H z;iQI;9}W$c$2jkI|FdEVZz+$@a1A;R9+bZ+uM5mV9NnuXLm%zWUW3{ob(Gs<6FGaSCVS?Yx#| zHrCz$I}mE4wXFQZUfxx{s6r!uU&ENbJ$8@zg0x1yN8OQ?jm2WlzJJ;<%u@JKTxQZv z)#O~4KSojXp?92Q?*@~~$D!+C|J*7hL2jaz$=tl+eK#8$`ga3|E?{>gzO$3hy0{PS zeSGQr>;K%`f;PP%j+VP#kqz+7@po;$FxSficwl=h%lBDi_vSdvc}Efz@FN-r|LF%<-jiJNxN|Nyts*TfjS_y8l=3VzSe~UebP==t-G=! zVt>>Ktb;be>${&kaenTOll1l*Z%&lUMk%N@#kpRro=9egj1IV8bak~wWCh+Ep3L^Y z3RJuu8iGAY8vgHrFB`odw1;A>( zzUTooWntJaEYnekP)%jAV6rlssQ$KjXZlz0Lvo&@ru+#BU?p9c!#I46DZ|>IHYYza z$&n1>%FbS0r%ozw6q^-bO2#}he@*~R!)DH!U6nBHLIdHBYh`No@EbNC&~zs`wYKdSC`=Kh65$X z#Nv+mqfSC$tRJ64X3Ee*CM^k%eH8ipNCOx-o85H?Zshs@7;(3h`CJFKpva_F_b`e4 ziDC=|H>VV91$RoEve3FVW(#u1b+S7e95GgPY^oU&Ixc?Z>X#oSzdpddp z8EH9|u-&^B5>iI`%s31?FwNK|nH2FRjIS?`dA~k=*rcuO3G^2x^Jn38NvE;iSD`vc zlE~LJvk`iD`_sKtR1p|YCDjgYHYy4ZKr7wyF9*6)spx0FJ6j)K5HVC zrf_$E%4(6gTH_h5?pNwpv^Im3$=5KYlXut;C@bI3Tx8B#Y}3`Nvb_8|%&XAl%GAxx zUxFPjJ0H-OpAfO~q7wN%*zqIbf*_!DXfrn>x8hm}iT6ac<62u$zGJUcgpzTchpz0J zb+PUE7B>|QzkvGhym*NqL;Wtmy|(*Dt;p|nZhKGc^ocS9FZaBXAWp*QG%rZgP4EVO zzGRvb&wDSzi{@e#GIgWWR)x?%qPFdvc?-3`SJooH;0)he>YBvU`fp8n%ny;{p2A6~~xP;q{VzrpYKm&uH(n>wUFB5Kb%b3SE|^N-nI$Df2mzzZU& z*&S{V|E|699XVPmZlSOpQ7V0s^QyHT2dC$s!I;@SUIQ5lY&a~Bqa?=x6jP&=2#7gHl*!devR3Y%^(o3q^= zyin=6JW01rEevZ@9xgqrqRq0;J#59-m`^|m{vemU{UQLP>Y%YCC=+}*F49FO-- z3MTlg_vgF@>%|SG;S|Qs&~-0iWR7>_1X7CMc=1mDZ3`nd%CpE1wPIB}w;%S8FSmoM zTPo)d7pRR70f9>nd|f+L1Jf-V*-_;!UFsxlZ#hG*U)csyet}k{DIXA6$A97u?bR?U zQO}fSA=eQ<`dR`PL1G$R_m^AkjwHj86X`u3n&i4stiT_8`<|?H7qxQw?eirYVJbaC32h!k4$9L-fU&Y@sm~swQr8Wh}((2oo%_h7iuhXwDNfJ zxH)mc`rq;@CwmU%!@jRBMd=oN2$Ttm^CdKiQ)jl0N|qUE;vV>VClwVCH}VLA%#?H@ z23*#Wk*XSDzshM3N1Cmf(;=JaKm0UK)nbEUQ8mdFv3cd&G7Z7mN$II9J8WIW)x}Q* zLQ*_nlT_mj zSlr~(e~SwXp8OAzk~>H?Wm_K2KV-ET0NunJ9E8u0CuKe>ywHQ0pTI zp-|q^Xkn;2TE461R>&Z;BSe_I>@@|1=ygAA2@DR8)igVR2fV#*iRZe_#$`K9Z&}8? zKKk~ov2UuNH=yQ%+sta%yw3(IivCpBc=$CX297^zy!_y*O(^x3e^+&6Ba1Sti}=YlOMuTGcq&M;%D4XVtdH3Z|+< z$No%UnD}Nk-tkFv$Mh>}sFa`hhV5PT&3@dSGj-87#>+r$DGOLlbuZn_F)mb3g6DDK zQQ4;oWLZ6*2%COE@toYsJn=Z+xZ=9c!P$BT+Ef8jpjSB(!b61%s#2aX1JP#!A}ckC zHJ$zz#IsB~1%it#mKRk^odwE`Hz_f$R_k{xA}eA&&^rUv`1U#e{f#T<^rh)`-`UAm zHON>NTVG_?z4K*Jaru(0iAOLYLpO9wp}WrIdVgTP%x-+YhD2Yc<>^6sRp4RIE+BsR zpXNE#N1h9MZra@wrxi$1<~4VPLpqUGf6=yw%6I%~d$RA)l)s8J_$ygGlB`c#X^1NG zu2)}B#k-Z%0t^{n;}y2lKvNG_)X43Lh&ogThQhn;uD;)-Q3q7o9>=>B>xck{eftIB z*LbNd4p3XC#V0;PfeieimII}F97O3sabGm2<%qGU**&$;K;}p{u?hSR6}R)JkVO|p zL*EundjaOIKnjTWfZO`V>GAVNi^|uf9Hv!I`3vK0!1+4T9Z5O|x6c5p)alGBo(z3) zdzWuFcp2Z{x0?5Gb&w48ZmV-<`hh-b$j$B~0-+rns)wgV^@wN;M&uoc{Rj zsD_!ryM+NVI}kHwCeV4aM$+QFWBdrHAnMVF<0b`K(%4{P7}LN%QG^g++MST%NLXs8 z{yV11W6y7pYy#?|P)g(B>VM1Ef-hd3pO8yxwY3RN3NDn#YozZfKOy;3(1^yWw!o~2 z!4dB@^fEj4I#`(kwxtpB9eClBm|+0e1dQ*0ZKA;ussAl~a0DuR`yVafU`#p;UR5IE z8ZaoaM6S3iKnU44RY2aVTV?x7m31V7zl{)^3U=zt#F9JBm%d>6vJ02Co%C4Nv zUYYKeeXb>$E=V^!PLwkN&^dOP-DI&C2#0B}{|-~|?@AhM@|*K;)G9f@1P1a7Ui}t< zE*Mvm0y>+^l~24ZS`Nk`r*MIy-s&uD1*>yfHG8Qw3`$Xj`6Js!qa~hhhs1n?ALb5w zef1tRa*{?eFo=NBOafqa0avY!ZWSM+!rwxZ9{ ze8L}sQRcYx&EzlWA_jP9jda!;k6P7Ib4A+QrrRk)ladE9FJ#ztQYLL?x=RnfURn1^M1R?JLx8yaEK z6{epdcQlL!=>%b^R$DC^WNZd10?PoILW$tq8IP$r!|qOy9p76W*!CAf%?z74twcBF4;Cq)o7M><|$wdieO&`^~hvqpZFC>;=^Tk%tYl zj8MO0Ldo2*3KwbI+%NRAar|Q8@m&~-hh_^mgMi-m>FkcL7WGA)M!|B+@^g8LJcpCp z^)@5?!cYmz@kqy%7{R)VKaLfo)TH?BkOmV!w#4b}h&>MaV;8(3m4{JNH77Im5)77K z<)ZYuj2P?@*Ma$QT~;S!W&=?QgH4ltTFJh3(aP#*N?BHJT7u1%+q%q@1@DIa2weK5 zuf^-KnD%%EiJ&7chKi(Z3z{PH*tVze<8pl9m*FpU9~iMiH7J@jvMSvQmgc=!c1O&^ z<|FPWFF*c5ry*8Wp4TV#D9193TuzFQ@Z%nmBX$X6O8HeB_}aC7`fcwhZFQq=Bu{&iR$fkDI)l0xtyFM9lOJE>0HXIK7+&R7W#ZG=dicnnK6vZX&@}3eWP?+2i}ek z4JDYAPzv)0`K+bQ2dVN!PkW(XEGz75FOUkKn}2hCh_16~C>zddI~zdtyMQ$zOP)ll zL7SUJsdj73=IOwbwJuv)~ zJ+*j2oZZiK2j6wT9VXSR1i_1!%j3BGi|sU(?llyaYxuZKP%u7r4H2BJn7^Rltrd zf2nujZMQpH=pVwaS36WrJM)nj>t>H-!7_xwO4scX1$5r+W|Nay&pNSf>}VH@ z>U7u%GWlp2RwvX{HLCL~@A9h%wB0p9v7oZTdZ8_j$eWnCCJ@Vrg_LmR^`Zr@O~^|v zMkk3fdTOx19D}x&GB{MQ`3p5+;<3vT>~zSY(A7^VD>mKwD?5w5f@|H5GL!YOl&D~6(L>&JaUUkLWPoLdl*rqBmc1nyW3cmq*Zbz z;2KW`cmUp3Tw;U)d~Eq~ZzKdf%0B_Md9ng5Oo3HFTWq&lnv0%3L5{E}$~>;^|Cpn5 zmkSs5IDRW=x~JlZHB=~-HWisG8MMz`xo{O7nsjQraPpef9$`oIMN({6k^qiR!zWBw z>D?mN1^Hc;tZBNhG`d$ht` zEbXF)tsZKyd34&4v+m|D6*tu=Nk=dV<6){Uxd0xXd0Hf^b^9^{y42IRkl#aFyl?&g zBJC~X;%c^aUm`#txI4k!-Ge&>cSvy8#_dgTw;+uM4-g=@ySq!{?$9)i>uuIrd!M_{ z?|wPw@{R5}t0t4GnzP0j&;L;=>-&y5VEp)*{tL5_r!1P&%1Y*z5E+AqL9H_E)fjRG z5pelPuY_z;mZJT79c|5xVcW23-ba5i#75VJt-=JBH#|i5 zsXti_G;Eh4v&T*ilelCOdW$L;DnPO*=NEh{?f5`}o6!@mo**;{;w4fJ10=-5k% zad}%`bzOc#cN&QPyxDru6r=1;q@(uDJJ)TZD)#HU>@-RwbiHL|GqWW{apXAdoePIK zIwBrgVl1o54T+g{ghBzs(-(pmbhLibIQf;}Je-swh;HGUZSnB% z{y^M%JU+VTAPMETGqyi~xkya(a)a(?%G$7G9roGZJV((YM_P{CD(NO0X{7tgmI#^J z{F1oL6b;(SiZ4WTdpN6TsbS;!Nf?+k@z(Z?$nOcMIg^y72+$}oda=K%q*@Uvj$sL> zc@PlAk_uUnv@`&&gF$kdv{?!g1jedLtXcFs1=1Jkb64xXkL8ur^i@;>ij*|)0obX1 zl2SXfpS=_))ogaA2D5urw5i#Zed73OfOhtwvmhtQhcdZ6Y?7CvR<+tkytz4{*x3>#1R61&UwQWaH?RjB2 zf`Q*M507s=Nv!AeSEMMv{aP^3;m3ccnhlxrLfKzu<>4$AhM)6q+AZ@a@B6072ljIc zWD^Vgc9fPYJnP(dbcMd&!D-^h!NFl5Naxd7(TuLj4nowAWq2}kD`}mz|9;lFDOetO z?5N=c{X7tRFX#Vt8VM9v$p}ddVel z&NoN!XJ9C|H$T!izv||8+?GX5PxLT6V05u;9!m>z9N&#lQ#dmHjFuH4glbPAw>eE)&Z`h| zZXCiQV=2@am_vC6cG}UYuO;6IHzP|LZ4P|@yC!E|?M7wP~ z+;e$~hO_Er-i#U{bz(pguW}|b$I(k9+ol{zjIPS|a_`&LSdu*Lb%}4eS4s$JhFm88 zv~*R~+d!qm`b&3#kS3eFPSSI^xF`N07TtKG{=N)S=S1IW2v_4S>l-~D|xP)Gjjwe&ts@ci= zBsyf|HV*tYBjApp28ZP{9j3<{fe}6Dm(mEcwh|JTualFv+s}<0R`fny`RH+kkt(|u zmBtlo)ep)0=PK$h0B$}E%?L$p$6sgb*Yjl=<>6!aay9ssaWe0cg`Ty*PR|5WyTr)n zvFcX`3a;~is+`vDpYeuQiCuT^hODuxq+defp$nCZ9Tqbk9+A}#-MGDC*?B_r8lFP3R6Oj*mtvZv6nMNe;yka&)*ma;0*m63n{8RhSh>{Vm6aNo zGxNb4WfLSM-ju_Ex3Rk1Gy&H?aNB(ATd(Th<;zC(l6=HGXgC#_#&6pQfRB?OGvw)b z%BqYlSgp}5IOY!^F|i1}UBQFIyLkQbc@Z)pjz;4Y6Rh%jTDp6V`Z+K^DrwO-eberD z7~(9NGhp?RKOg)?@+bY#DkQAg)~S#uc=hW#=3&z;kw&)3D5&|c5KUAp^VUoy z`~3&l!$5%_Q8nu~MJf*SxF^_-Q0VWd8IQGKshzERzESpef2KFL`@_wpk{h6Y;m@IF z-=0wi_n2c%M&^9NnoM@9ut7i7c*RQdb&~RJ1l^4UQ?&7DAR<0!vEyA%(AVLaWvR#Lt?Nfy(qKwSZD99vgMD6!pdPxEL|DkolKGG zreF#pn4;WzHs(b_a85k6`LB!FczpT8@w*uD%F*+s0sQKwdu#pi);?siIfn*aP0~8q ziH@CjVsmr(f2J*jr7juBwU*nGa3hrBMg}La?hPn2N-xqZ3B1FC>`f&W_!UzcPR3gk z=t7IAuB;V2wA`@+jn^J|G!sY6d2ZMFv4nWVLMlqj)P%BrKLPCIMYA_n@&O;sFSw(s zBoXlu4ez>jnaR>A48?6Xx)O=&pHC0VwiEBk>04ZH3{2GK*J^Hun{J3)ZeGTk?`|qp zcRrm5ok#7*Jct_Ld)f2WW{F8Ej~z}=tG{n&>m{Yf>9^hTKtDhhk6;GoY?g?5bbIk+ zS^Wb7{8vIw{Q1=z_W#W~*l76r8AIvrB1hy$1wGDT_i{i4EMHeJDFUNFV8F>siEH+N zbeL+Tw**Ej=^r{(Kf$Q^#cVe$68c+1eI+2A>`AVi$+G=Ym< zHeGk2xb`VB7&+lAog$3HMvn^zP}@Q(lZ@Be-W5zF7@ zy}Cw20DA$R@DW-*aZ`-ZT$@}41{YhcYeW5A=XXn%6$BW~ z77lK`Y_c^OLE5m|^_}}meS`6;y|jJ%=kzu&f5Uhw{QtR5#R62-(@X_wp31G-Io01s z;xg$Jglvm1{$z^l1&|KJQKGGL){jO znl*vz~_40Hxs%{=irBQ;y?dI3Z^M)EZIYNxA-unJQ@VI%u zU!H;T4I%7Lwy?JKe7cLt9To|kMw>+};y;xcb^pFu{_dS^`Ss`kxs#2fqjrfVtX)<~ zdHJC*@_^egF<}h@U*xfL!n1j)-eiq-XGgR=sA&qBcVd; zZ{dpi?60ovgc(siWUK^?SN#u;t;Y98*&F;9SBUZOc(bl14=-OKCKVNqWphigpZR&q z{{=EpR8&+}wx|I?ATDArcQ2#H3>nlaZD>@f}>3<+(4Pgp}>=sDGY%@Ptw#J7ygdrr5g{Uz`<1ra|!RAFt@Ju8seev zeV|g4GiQWNs*%tp2egdwU4r026gX$xjPg-XqeJ{}O`?o{5o^3mtaJ&Y1>V8>n%KYc z;iyD}e${T6@$q;ySvKrzkNPj@AvSf@>%@bT_&=Iw^any!fWzwO=+Vo|%UR9aIUHCi z@ZtYJ&Fp>;{Q&2TWLZy<9;*lA6h-yjFRvTh+1bJHF{c6NzCCdN*kFBl&k#U@CL|zm zhu?8q(zE#)ADswRRZNpn5^8;K$;Z#c%>4YYZsL1XQe0YA2Aj}^q21lx_{O(TsyJci zquIVXx=9%3#&Vd3PYT}xZy*yFcdX^Kz6Dkehk!~619)cf!3Deu zmiqiU;m+%KodSIw1l=Sg-@~QR%s7R!z5yy&`~ubk4qcH$F8c6=UY88+WQF9!M2X^= zmX?;HG}PDTPJot@02@mhx0Hlj_Kfn^F2njvwdnVhM9{gVV9O*=R_MVr%vL4kf8tiE z7G|NJUpv#9u?c4#`?C_v%fr*w)<*iec62WH*49Rs?7!Y@_OhZG45M^Cq<;}rHZcE1 zRN4E{a2xjDUlQFqD8K%<|1aSxgSdp5YTZ30_Vp9{lCSN+>7?p4A)PWKQ6+(-}{g?nG)1?fg4YZT+*i5S_SbUR!F~?+J_#4qaQz-;NhKwZ#SrXuTLZ?PWU?Rv@9+A z+ipbd>(I7UsfG@6t!=&YgwqGeMQ6T)U>MkMuqI#<7uK%isq!KGbDfpeHJhqSZOz46 z{ZY%F6OXX2-{qD2BfBWyVWoZJ(9U;a;yU4zY)28;bYgcqT*Wielu5g8)!D5t6{zq~ zDL`aNF+xqo`DNP@!aEkY4{wR`6rC;JTSaLbE_Ed z)w;}3ONBms81Ltk%IwZL?Iiy7FTw3`cbHIq4StR#w(s);|!ke zcpn_#WpWSNSE(tz>TOqjegan>BN|zUP8Kl1@VTkS!E$$NBE%;AHsWx8FO7zd@g>(? z8YY3hf5po=(agffQ->3w7b!oBW%Sb5{2)*~#4Y@_+r@s(iigp)RK8Pnr~-MDl|LuU zCUy+hw?km6Y&w=XS*_h!OAQD6+v@UK!0xX%6t4HpzF;7^ymVUWR!?d}8Aouz!a8(u zT5fI-#VVpQ@NvA5b2uc5h=?8sIds!Eh+uP5(Q)ao*OL!z#_H;_6H~K_%U7!If~OC|VVs{n@(|3&+^T`ac+ZlO%f_$!P=i_wIUxFxO5`ytGUlmkPtusHm5sh?~& zVT>{8Vcd5whji`OMnJtXt3@tUQ%g1+!G*HDm0hv3m;4J=l0fd-#m@fz?(Xj6!#a2? zj*E-S){gkRcJaz{)u7!2HA6h^Z$>a?ZN+0>v6}96`^_xg7IW2_$ZGOTRDhq+IDR=D zb9hSQPSKqNw;3~?v7X32?)%T-L7@i{75{9Ep1LM6?EGSz>h6IAil`u_qwV6yIXx=2 zacy4niFuWVE2hH876$rrtWt`)kAr4$f0*Tdx*Xop6%@8#wCOxQdo!&$7p*?u?-e5- zj;EY1&mAi66@N@3aUt_AD;}c+OVRd?)9*iS?&QCdw)UgSXvi=U;>ooaVbK zh`zxx0s{B<0WWhI3-&<3gug|ZPSOyLugOBuSk7YBc+P5D71u+0Idksm2-{MI0RZ1+ z&g*`d2OgYtJD*%*syx-pxM{wA{|H5ANq8vUj(Dy}dRX&)GTGKIxW8Eg59`%XhRs}o zU%d4NJV4z!{+DNMuI6huw{hf8!<hX@Pqpo0X)K}_rx+x^KRi9+_-xXO*|HCrn4^lCoLN}OJexfplcQHM zxq}wZx_h>%gM}Lu8VVIbg$hckn8$rHZa%4s<@L8kx^6eoSH*9gG1;SRC&ORF7InE zKlai!9%9x1@_v*xCJNk>+df}(Fi`Qkc)YH2dMZf z;?s#Fh+YWBB^R3ohOn9eC`HNF)(3gI6 z2~ggy!B(_y6hxVK-Ewj%k?*Iz8Lux%cuOiPPl5>Ee#h_0w1n1bGj=#YtCnTRgjz(O z9}wN8D!U&ubg&>v?H8byfM#hL!^;Ox6Fn;Il+{*#mlwo*#q_f0>&bkuXYtEpkSAEK zKyhX|q}FGy3Ad%C!|T476^FpB{t4Kb#-+a%XPf~T%lPDr(2kG82+0~)c}|j-e98!1 znv)PlW@~+Uj-gsb+8o;TzRot%TIV+Zif_2yB=9@)=QQ)~1Dy()6fA+kM!M{4-rbtt zhNSu35aYrsB*J`}2SuNmhB;lL2ya5H&Z`l>?7w0G*1$eXp_!Sm4k_e)BMtQvfS@^& zdwE^?HVwF(k2T>xGxy`ti;0}7G*6ns!8MnotUdNN-Q@UFhP_g3$q-CO)Nn+D% zNULOcIjF%`IAalF5s}$*Wu=pMf6;(0{1g&NHUya(actV)4XXQ!$1nMQof!5Iq{pe8 zzf7QSw*yOx`QWfLh5*LKihJCMiPC?J4`Cs(l)fSN*lZX_SG9F7dHbD2#AR#(%n)5L z6>_Lf*>R|OCY0;Cd1~r!k(KRbltQ~7o&8g=g^9_4g|)a{QF>?Oz;K*fMW?t9wisyO zR4_;Kqt4ay*m3kGRQhb(OFVmXA*t&y$D4|vdKGsb-~i#oirq79)byUP*(FukrtUsr zL``ISsuKQJ^V5hNG_E;*dgq?)nj^hxHbf=^7-N?yR40F0Iv-W`uS zHX?L!7%>$e#3BkCDf6=N6YM<6F7IV{Sf|Fu@1c5<8%M$R_QW*=5;i5 zJRNZousc9*@03t+*Vksz4N;Dr$(t6MlKuw|B^d8@i1kKF7sabrLTC%Z5+Z)+LFWgg zox2Y;iOfuI74y|ay*wOJ;YFUm)1Krxj-FN@%zYP?Cd!h8*46$VlN&D_8L19gZkdBI zaR6IO48^5d-W)c8sWXQc4JiOt5oh(I*@@BgH)-;-;Z4L&GA87=MGAUu!30`E7z4Xw z6O73mlZ)@Ub=qMbK4bH1Q#LNTLG0Bl*6F2)z@uVa`>c`Xd5-?i&bmY_3_@j)@Gn zK0BK_xH5WZ=eY6MK8=&f&k8V?`CIGwa@(ui!Ir<^05W!R!He~dp!ylRqO;8w*WtVf z^f*?I-+ik?4!cFvwUM}?0{-t<=vk7ywjk;#MUC$<3BBu9NvXKvhtx_KRF0jQ@!gva zC=>4}DY@?Ap6{pp=(YxTB(_?oK&#W7)~EN^FkArsS}Kd-#Y(XdxNfqLGtc5=>Dg&( z>o+&I18W_YSZeZ=g`M$YrpRwW$o))Uw(S_4pHrHe+rpZ#=jk0AJ=txN=_Ln^?Q=O> zto*^osZswlEY|9+sD?E!dVUjOXGUEacndz3&3>Oj0cdlq-=CHfm}Te63U;NGMwW(o z7JA9HpQMG3uO=3iAl?rqb4S@BE;cQyNm zVtH0F|GCe=xYb9f{ziSp6dm zfjDK~KJ=|2PfypqJXI!-CzS6{%S>CrZoxm`cRW zKjq3Zn**59;?upN>!r2()z@y({xPkn>}p#~6lz>JJgRI`O-roR{=6&A;|hbrO29&5 zP%%uC{{R9Q*WJ<8r=#+8Yu^hB039B7JjJXY>{UkhOBEe#bs{>78d)%kewJEspe>n!+)bu1DqS+1QfZ9_Ff}!*;=Pxe+F&@|j5b>o zSI*X@#bK0kZ9TeVj(PP7N6sh*tJAM+k_TNURVRP)X=8R11ugjMs8XK3a&s8Ydo?!X9} zH%U3dUKcwIHK1S#EMxXoFE0v6US7P*DkUaRBBmq8Z&G^1hRl;Ux5WL z6zmQtK8u8_=Zb;rO8KFEa_u6{E3IZP7`T#>#!^Vo`NeXu!Kw=P$JDoQ&R0J|4@^T$ zo$>bSsU*+8JsXc|EdOErBF6_Vz3Libg8Nz|kl8NQmJ4LZ1P`oO*0B{N8FMy`zPfc- zf^g4!_ObmQ-9?^Z0lf{O+Mcr|@s(Z@%2#*IkA43M!QOWL_;+mR{}R&dN`q+i?ZjHT zB-3+uRTdx4Ihn$3nhUqY{-Tdr5_gE}W4@kqC< zA=%AdT!uUbEB#nN#`u$m6#W}KF?*#y$2Q3 zaOiYM5X;!=J`slf;_p+>mNr;qrT=4LZPJ41qW0W3KrUF7K#}pA?`Z|n7)=aQ4296? zx#Th2BgPj{;s-`bH5y^d$}wKMuA~Xe*(F%)CX=q<;XRE1x!7Av&x$Q@^^{eN$Sk!Y zvr9dgw1cS${;TF7v`q1NR~~C`@ckzBLVU$OAnuLWDos@$RO7DV8#$~1-O?hTLs*Rn zcc_r6SZ`)|&eGXyVx7!{($((4f4Z?MY3PI>NvoJ6VhhH|cCO2>qPnyG?f(zfK-`YC zJ#9|Mf~$&YIsJmSHl!e|oM-v>x#VN)s5ai(CbjIxiLPCllJWD}nW8>sy zh_$!=J+r7cJzC&A{E34}5+es!c?vLl)dG?qf;3f~l^TB}^Gzt(RFWMT^7t6K-+POa z-(23-GZGy=6dskjv~*7g_@dr~q(<$Y3ZhAl1rqh+NxRvn&%~a~!RQx9YTgNk=4VsZ zB?$?pYK=?gR~Sk105m<{3qZ?Un6;m`n()Y?TeIWjUSYMhXrQ9RH<{|Ov2yn@fV@mA z^SJ5h2WEa2Sl!l{77sa>k6z-=C_#Hw4+gge*!@8N!MmxdTD*{hQ*^rA<~R%nA}Ld) zkCCR~pwbwLib~xK^d6!_Fd+I~>+k+-u?biIY<*;3uy zr4!L{i*nonl;k9m&c?6H@aqfe3VU# z!4+>R`Zv~$F%iKa%Z=zU3m)71QyjGIJXW;x=08i>6b<;^_SzX?T}7(RwG+IHGrM@^ z76l4zR)PRtYam=Ba>!X4S2}wr5vwLnZ??bxqC)Nl{I#x(%%qQzN@{B4e*GXIazWq( zIn&xyg)a2G{d*@iA1{&J6#tY>Rh}GL(vgXFAg%pLy?pfG`}(#PRHwt=X0#f2)AR+$ zM7_l8QMNX3;B;sa*b?{avg?}@(78|qcd*{bTJUVKd2v|%+C}2#_gLs1od*%dPaI2A zlZc`!r{ed>5HXn&PHVE%OgL~aCH%v)Sk9*`#)k;k_#@b{p=jdN)u375V89(U-kX4u z>o@hzIffpKFhUP8XAUCz06hR13G>|@1K`o(WO` zoF;~paA-I3W1cKs0h{R+i32g7v@?yGKw?2c$&XA!V@0!|L*K?|960vlZtF)m)+~9T z!6%|DsnlxC{;KWk2!t>xt7-Z{p0b4x-k2PVEY9ij$W$6KEdu9&00oqpZywM*8euo` zUMo1m5D7khH-kAz>sTe>MUJnRpRkgO2wqW&W*u4AEM`M|;`oj_?iif5x>>1Zu3Fv&2pW2zuiV07&&C8)l$!zNhnTqlVgFDlGZ|37*8|CLcJN_+Dfa<^~!3JbY^`u?xn zB8J2#{(q%(|NkZ#|GOC-BWD@pI2J<aTN9)wH`nlcOW2U@q^iM-g}(zdjcTkk@( za{z4<bA&V_=Yx4)ExWHPOzd;^a9K z%;Vl_`Mfp3GPcVQ=U3)|^>K=d3tEkvKtc;LI+=5;qN(w`cp)AFU4^8Sc+bn4b= z1v9OISnl-VHHKDimN8DPz}0Wr&*R$;ph!RCo`j=z;7SvO{40j(@0G>8lUjbVsL;SE zW*IG2JNKJkJ;b-8`LX$7Xvg8I?Zlqt6ROh)q1nbg$_L{)zU=@f-G5hyrGDO8WlpG#^LiHOO_i5!kK`S+x zn4lWT5O*ot^}#N0+43lT?dD}oO#gH0wCc0qU%$)Ur zo+TQTOSoHATIw;T+k*aC?vu-I)P6BXo$`Yn4+5g;1?9Fm7SigX1A6Otq+$XO>itC4 zI7^SxV1`(nQ)&6qy2Zs`i^%HCY1fO~NYNKggIDNt!p z`)bT@PIXP2%2C1?NaD^z1`<2?<Z)brGcUHRgbBSZkR;NVCktH@6Ij^o&g&8us|Z2TND{o&CHi)ZLI?x?lZOd< zLw*|2DrAdaMt_fZv|q;Wmx&unM#8BXI7I{C_#03nm=q%lg=k!@RUQHAg9ThYW#-K zqJfstdW4nWK>{I=5IN!>Wf?M!{p{`ZUdoX05IhqmNis>Tz68r-Yl?$J_`;!3+m~<2 zy-F;M5mcgu#(`~m67E$;_{nR{lKUAm11_3ga1qLcJ`R zfMe!9+_u_5cBFdXz%`RU~10$qJ8fqD_g#x;pu#;2caSyFU)Mk`| zO$MhlG{jkqQZgxtelK8_{k6F?P6(FdAzB3lP%f7cQp*<+>nq(W3v^fzcaR9F4D-74 z!6L+oR6u`Q-%lnjlwD@dHD1h#xrcJQpL7zkfVgA1o8)KXX1*#0kln$R#p;VjDKfzu zP)4)g%8tcdYZ28PqtB!|yiKR)T)H%f26`|oGUspEt1`?s8!ne3U+O;9cuSy32&)uf)xN7DI4oL6(v02gqFr8J8b^mIUfGOFiz z%6vzkZ<7C~Y8R!TQ4TN_!Za|VG{~k#Ae#gM9R5&ms;e&z64Ntq*n#M=Dl3;0IhjrU ztr+;7(Q3)?IGVR2We0thi3#JYDkNIh=jBnKas9!)(1m86`f2cu>6X>uuO)$dZ+;zi zTF}(8F6pgv;^K7P%BcC99?b0`Rd+HifDBmvZ7|Q7y~4?R6-NyaaEj1^ z5M{>u*h-FbWJb5`DvVJ{6G&OZJag?{p29rBkd#|w_R!LraCavltV+khM02o2uSR$W zz3o4u;vu3Q9Ujl#7uM#W^;NNuRV0|#E_YA#cPI9F_+rWF0!KiS70QQeT0gK@A@p#1 zA;`nXB%nqnT5)~uP3GeP`EP}Ab;&`33OUjUu7 zmsk)hd4Pt8L}1p&jAnO#zu)GDsa&I7K>TKD2u0h8+C#!Sdvr#v&b^aqWRz{hGr+%~ zXD6^@ao)@%hX8=BRykW?v#Q}F^SGEdI_j4X$!qoCkx(sej^hO@Z_9O9)L+3@&brz4uycBG$}jUkhmw0bbv1%G_h; zngCeUv=|(|ZMbmkcUo*Wo+S0M{v9XA$wCulKzjtBPEmc!-*DwP=o;>Pm zl=HEqmRAaLvZ|W#p)Muey=5F4kKLhQ0}hxaMYFQTS!!&$Gk?&8^yYsy=S*gank5&h zU++zv7*W!&jxLVg=M}RlQ>6UgG_kP&0!+SgXZ_@SHK5zBY4)^|pBt6M+lHbp3A{q( zd2PFLT0|}yx9svZ`NApHfNQBD+3~T7BwgYgZd=1Yw-*sCb2h7u^NC~z1O-h+@B;BR zh6kqbBA*)v{8MQ00t&u{=TtF^(T(ZPoowvxStMJP};m8+nqtC8)0wQJ~*T`%QHP=Ak-7|NLN$-%t=O-zW>(-Y8l@g5r= z22KuP)p9Qn-`bQ7aiZdRJK@J*SE zX~^9*7HH_kPWkV&PlDdf>qdm1CY-mG`Uqj=WF+^?>$@0D4`LhaS3DJ8S&1#-IGR$c z^VEA}WDTz9v*4v{VrKV;|647{ZNaA+4Fz}8HGLR>Jp;;TG{%{(}&MJ ztEc6O!bllQmZU;K9Ww*-?TCTk)?43&B_?2yr*It>7%eKagVY237pU9S7x!|NuDQyX z2dXP;uG0fey;W!#2pU8Ygs6N|F`KOOVP-5GUf008+z#_pBoulVq1n=$E6FV1Z`LXv z7(-~VtmVbzbfC>Zowyd;&ULHj-Y`s!3H?nig3weG#nnz>N}J5eik%pdz(;ozScawq zAZ|_;l-JkZ`FwgHVJH?KKt|iugRqu8TIC2SVU)ArXgS$(mPQ&cf$im_~#>i4kGS2ixSpRQjjJL9h!0A}J=>gLjS zCf$?fn_&-7&h*{U_!YG~zSs!g$!;Ool>o9`$}RrxEs@sJsKH8iE5D(;{xg}!ky97} z4s!cT^@Ux7?^%Xgwt8s{i*QbNc`<)r-P*z|seqm}aVGq?~RD_IMZN4J+iei!C~{lgh`N_OWg8l zZZ%L7t6R)WWvr{R{kQo@YO-8^%F1u`Bdlqhg!-xeL5Bg1m`J{BYXA>5XOQ@{pdpn5 z+*A$7F12_F+j{YH*_a5g1MgfK7h{l&hwaICaN~lbD-~gu%zJdQRDXau%Ci__gs{sH zL=ro#%4Q$T)7Oil?nF%_I%kPAo3Y?f<1=XA%DdA0uzL}ELLR{|G^V78b8*g#hnXFE{=bQv}XV!V;41Vxr6B+$u>kv6Qm=kCuFjS;Auf=`L zdM`C|>>?n0G`8K3e&I(1s<3rPwHQe?%8+z}5kVlrFW!3mmCIxwKFD2uA{WC#Qd^Wq z4w1lO_BBdS^-PuP;LVdQ*d#z*-ASaRMa@33R9EnMF zWzh!tGPmLnnaZe3P)@ltEi)R1TfaAPrbLqm=7f}@pmy`Y2U4$}A@1*@|2<`&qeo6#Mg=L0)0*PD~uUro;71C19Z^hjp7r zV$zHhgOnr(b~3w~IHz=T9izc)o+LRe6Em^9hDp8Eu`-_ zT^fs=B*NZ8c&OmpEpG{rcF9}})0TreAh(b;d6Ewxz}6s`$MfVi&kTTPiDfy%olTH4 zVMW_Gq=ff8*54sRO%(J!$5^$VH!sHdRp3XQp-J9Q$=fzWrHE5wP@WVgU1yh}dEweL z`uPf6wNNsn4=WzX>x>VSvPTnBgA%l$nkDVOyUu%CRZ?+B*-W|Ol_b7DB|jMGK!}PS z!g@MG?pFzH{dBe0w~Wad782M)+Dq^mA>(8!I(sUXZ0vwjS|(FR&s)yyueTQ=bmaE| z<(FH%$oKjts|#~7NlD4t`T%2eHe-Zhn_un|NLS~LhvWU&$uZP|CW+c9C471_+d z<1Vo@>q{bC#u(1~F6soJ{bOhJc~Okaz=TPbSJVmb4N1j`Ks4U~0|?5A%V-w!EwOHE z?g04$(j#i9S1tKKz2BR=CmrDv25yPEXPaDUw-x$$??LAQ-2VL)fj%Q`a+Kr3B~!W zK;8FI4iiuR@#W7p!uQf{1Ne$EX=!Ht)TotiUDGK?Uu{{Vj+ut( z(j_j{du?3s&B~T7cx{9lYd+;E`%rOH>rRgqcS5s{yN(ky1k#k4d{kDp)NZDm+Fae^ z`>Ya4>zciv&&uQzSN}0#(=K&Oy?+UC^wD8-9!-UpSHSMf-hOy~){;t6M$k~=k7e|G z0OL9R{EjDb$iZ!NHn2(T=LL!2Y-&@0Cu5CAfvNQN3m=h{c|emd4-ttw@Y`XNXkg3ebsfoxW@j4xEtq?FBK4o4$AVMv`96~I?Mtlgro zAF{u0#!bXyFgJgS|1pBeUv(kkG9X%7T}zpTtkl84_NIPL$Kh|Cy&vW9$?4@;6)xYW zW~t@KdW$?s>>5~nruY%ny`RcHS=Y+s2{^UY^;yE&wp?#z=R*dUV*l{Imi z&50SXw26**+qN8Q*Owf@svHep*u2JtxO}}BqqE8wZr6G*vo3$b-4yBaDHVAwqw1PO zaM8$VpGB*pKB#!&X)u`DIah0GCysQeB4N-tWA=TSDI>&6vHiz0G~_rasH9@l3^Pdm*& zRd($%gh%Zu%j6k=ZXK2r{n$)JJoe`l`ii^(Z1i*LvsXM{%uPY1A}p)2`cf%X>cmu# z%hvwIRpo4n+okC)wdolSyBW2Pv)Jg7O##Dap$nawx}Ilki1 zrp3kbGM9%b$yHx_I~m5J_ja<0R=O<<;2TGu+jj()Q_T)kqRoH7`C; z`{+?w=H2Z*o>-0#LE(x+kdAjvKNum|jnc_+Zzjh$C6?^u?t(Bsplp~s^tq(e4vO7_ z?Y~;QezplxyGr3A~j%67bqwPlQNnDQ{JkX>>p|%Mzg-by`l>X z%L65MCEly#DEp!}uzF;1b}gquR}tgLMEq;LvTB5MD)39iN7m-<{e0^AnF9NuPt~*yN7XL>Oi#sb78{k%#n@lsTe}{9dHE?t!=NfBS(5O;QI3`$%~&G9~}(MfGy4S@`$wNt9OGW zsWP~HtfKtbntxiA6PJO6skrONj|Av7r$#u1L;!ZwjeB8w6QSVs<~h%ko!payfs)yjv!ZIvWCia^A z!NY0Oer&mc9Pio(HhaqZQ>$kxF_J#batfVZpQ@^6@^@(pE3S4{EsW(Dw{WyzW3PI6 z*qt|-8~!M;x}FDpCOXsr88x}?Zgeg1>25%=!Z)BXxc&pZBj@`2&UqdmCcO9zFYXF!3GR!y zal+21df>_I5S4q2Q#>B*Gh>e5|5DLuVo+Pbeucv=FhzJ9Q|3ult&k}F7phH*+XxWC zSRj}`I|N^Y-Gxr?R{-bFb5(Mi)e9-jDcRerEU2wOH8PVnSGz~hg#6#R82@6Sy9fim z0l)&$akW;=Dx#{7ks&L@S#WtHkg{4P4n z;xnPXJ5h)zwi29MT-xREy^~IbJ+9}37=F!JT3?jKhGlvRsfDOpyUdTWd7Xu(D=_~K zjj{R?ab#|0r5u@H5Wh38j_j2xr2$Y##YhErX<2>qL9BJ@Pi+ai@4LenW}7O7229@@ znH?3RG$!UXHwT-V`H}XWW-g64*Tk$cZx>wa?~&7Z z3YOMcZ;(adG2XiJ%g+P_Erg)W2iNbY@#}A{ra3PQmhv7J$7=3U3Wlk)H+FBVRwF1HE3+m}?)&w<(Q4Z=D73`EAF`yJ(Y~=5POLOlkhv7sd@3KDE4B>>B{cYM zeg;D3h4lDVha+?!Are|92Q{!CuTcQtl6(VMVQ$LwVFc1!!VyckolYmBOTt;s3IjuD zooV^bHHypXv`NznyTEcw%_7_ogePm9oEhdn$U%I|@A?PDY!`C}BMvp37GFl|V#o=l z4-FP}T%nw_<3?7xy2U9!?yG%F9F|yJnW0sl)-p0KGljH~w$_%w3&%rB0ZnQm@MMp) z6Xi5d*Qx7^*3Sf~EusXHa5Gc7?gEaQ%%FDMF;gXFBhId0U-yzB&monubVE`MFw{?d zOht|b+mqJi$7fSAB1uD>E(92wkiynFrwYgv=vwl2kW1Q4RWn6KtFKIJ5$G-i<8pCw z+}R$QDXE!ObqZJg?OpC3zFA`JI_+=gebF{n>lnwQ?CEKp-*PuX+~OFPK;th+eAq+q z65yIMcs^q$>(jz{M9J`&cy>`#({F0!eh|KFqo+kn?bll+MlfJHY3SWIyg(jGbtH5i zN%c5uj1Ks&q%!uqprPM(og~Qd?Xc-~a%pNE_l0ZSuD>)f4LZNx{6k<|ys2U(ut$Xy zf1HE)6slusXxzWxv66o@71(ASRmpu(+E6~4WJ0=oS49DL0@{30=bW8buY~fppD~lg zQ?@u*B-c!O2*_Vv?nmo%v!$ZKP9xrvTJf9$F(i4Q4fbZN4~SE+coNHH;$_Qvv+y{v zxQc8P)-oTtMy7q`By(+kVTYR^QOkfDw=)%=eNi2wqmL!k4k;i$H#Ue{^Ug~6A=0pB zW@dSv2QDIK9+5H%zLt^c-zs(Sty?5f)31stuAg1Esv)=Zd1ZAn{9wVeUh!FJhgx$ zvR-wIY;X5$yhFV!pm6C; zt{sUq`9J$jdH#pRVH^OoF-wHYW67VpWcfA)kApQlheOCqYic)F`q-wFbhG*jyKQx& z%_FE9yfP0&e9s3R{8ddDPu%yFq_iqOK+9_GMts%Z;l~xS>4pz-mTF9|U45mJ8`8&N z23U8}zN#6NYx21p$ETOGwn%6Pb9tKDWnky~nJ7XUPeyhM5I5w?XIKF5C7pj6C4E8v zR{(ux9_+94(7hnUOo>2H$)WzgumCRuiV3yl9YV0g$O*!rnz47{MKe9Pi2mey}zGM8@K(b8%*+1SQ zS)%|z(OZdOQ5JxB;Y!7R-=)3CI>=Xje#|btirP9>4%mLK(e`|G-a9 zO>JXmhZJak9u(^2eE!%y@b>kyPnrpMA+?3TzF7o=;d?;*n{UaZqcM?5|GY){Ud8m` zwT--HEHoy@K#>4h9C}(*TzqprzWVQ$qeTSvu8ssf&lykwzsIAfMGr4(AJ>Stc|lmn zXVYKU`Kel%?w=x){_op2(V{KRx95UbfVQYc`_=YP{9ta`d1uMLHySsFI?5Bjr$iQ( z>wV<)G=L;^9+3dPXPk-qor|~LH9a|nK6~@`ga*?7=H!EF%<%Z0^`2Gp^FF=nL4S?Z=ulCFgW44*cYX*5q&|~P)$Hm- ztFrKI_@aAtiAdV<_*UVQX6pwmfHfL({pFnx3y!~;%k4z)mp@*s#;zytuKaO4L$*nD zW7hK4*YPdNuD`cF*|!#nkTiM-YQlo;_JqAVi{-JG?`g|fSribfyZtg;TokXmCR9g* zJcy!D_S+P1lPhesIqc88CwvXV|Cmi4lCo4vU%d?Ord>BkgX~qyQ&Uj*<+89E5o+&5C3BPaQloA+=VunVqEPx8wRL$Hd zrS%9ZcJ-L=+OXGR_CV$~v1-rnaNT3o+cAzV4~REoa*AMq`hPGo%kf26@kkm-lTKlI zqXw&)B1L_;L1@INCyrfrUGfdnV6>63g<&=-G)puP08qC;a7)=jLlqq!EU%Q9@5=H{kIn06mrJFfqFTQR=a z_Mv@u{LV#H*&}KGO)Q@0szgJ5dda5xQT9)7tQGZL6C5k1Q2kgN3l|J+ZDwD#U*#va zK5}qhWLGgP8Ak0e@C*RwdNX=r_&h3;d z(tLRbo;z>`3Ql?GMt(rZi5sxA{23Yu&2LBQs&yeyg)%ybA`?s6Qcih$>?AbwQ*Q|Q zxdKEPM~4)CaafO37E8bqaKyB^yQN%a@I~&m7nxe9jZeY!Y=aNBi?B5cWbFNHN{BE4^fFAE>Qes>>TCf;hwlj$pYg@P;haUd*+(nwZx#M z6my;4GW=z(C*x zKW1PU0cp6lmX>b2lfw|5C)vz-fcd#%YVlPmLUPN+f=TWLcT<8uxvio+(Uv=)ZQueg zm|IdVDvC}B6{N2Jb*|mAF;=4ABk2R7JRCXVd35`82l2#Id3QIBxS+di)KB`C0n+1q z!1k8MxVyx}h)7T?3FE|O;$j6YUHMOSf}81i%-x{cS5n40{rz+C3;Sm?WjiKk-4o~W z3kW9+&WP|N8gx~i(ZLHX6o7WSR_T6;BclHT~kj}*$Nb8a{WtAL(7&cJA32Wvz9;WAL)CH!rH&a z-mumo8N->EmM%W5Z{RNV87T7%yD<)$7aUecZ(o!lj^SZvR?o6aLAH)+A#?^|biU&H zn?mS`23di8XZ_}8GAlMjTd`6$kUDmDGA&LE_APnf{PQMn@fsDbV@a;I-|6EAf(xTA zpUCcMwPyNF$3-j`TWCOqak%t};=MIj?a3SOdSe(deh@6@IjTc?EF?uTvZSqszJiCR zwp@dx}biELHL>CAh%?=nrgzvn|x4*r*XleUdp62;YU-Jk=Er_oz zDVA6P#o8762gqKvzpv$gA$OkPaaLy6e6i(4iIe#`->Azv+FBrWV*wqno5$-=z;L4^e^?zme9oN?_2d8*pS* zdO+drZMaYOG_DA<1*eJ-KH0-?;i6*g+@|fyb>b5KvgclzUB>=Ay*)P7bXZ;vV@&|@8kYUQbKSXB(4UYA+cp_0O!PY>@Vtn1khS&}Yl{C3VGn0)R&sL`*qXL0c{^doj? z)sLR>UHs&RUrMK{OhpnzinpoS`zMuz8GVyp22So|Go33nt8In`(RPOiM^}75udAGj zt2cU&M`*;v{IRmFC+Kq&O5j&rAlHwtLnTTy?Q6LO;uSvT7sad?S1tR&q+2O91hmJC zUml7@YMR5xh`Bi&uDm7E@}j*N-zdwz9AA2fJe)J;`}S;bcA=Ls8t)X7IBN=1gc%{_ zO}m7whqF*??_Lf}sW{8YiKZvoR?+yjTrA=iE}SkUsx286q4x{OA4=B84mci5VBybG z^6XJx+SRz14%cfEq0lx{45Kr8Q(Syu5v-6EE)&7$8BOU0y*3lz@U8iHlC`;r2D>!Y zXVB?&cV-mg+PTfGaFO?1>+8QqM&66)v&#s5)35&%X8QNbzTZTbtADov0M^lcodCc-)u!z5lE>A9-9xwC z(fstgSCdFTy|(xCzO!@2?*<}z*VQ9xRJ+%Fwe&>)v{5%dKM#Q%{M|ALmqt3#em6-^ zJNvU)oF>ZUS$4Tfv#k%UPaWhvOXgNK8+_2Nh!bVN3>`}a#PV@8?|2fT{)C)*`d~va z_K4i)hwNB7H8EjcnLPAL9PnHB23BryvtxlFuKu{$dXHKl^luLTpVqraYQGBzb#*P5 zMww}1SMqa!HFekPFj{O@ajU(h#9ANfjJusgwWmM0kJkaXBFFAz44hy1P`(rY!~XNV zq;5vX-o?S<-rWtnjwnh>C2?baK=0=E>3nh7!gHt(`3xxjS?Qd+?JM4C3pl}3zp2r? zJ9hKk&f?*EOYy8tu4FOgt__(;F>wGc|Yt{`#MTWJrN&8YyQ$P9ZB_?u}B~KoQDo(lgAt$$J+{obWyJPmu`&XA^6~oH9x{=5zFPnm)HhyQ{t`mrq@_!l-O1z*m z!}OF>t@7~sQ(tT{X)V{o=7fUmzQ(G!n!p(s%Du`P{VW?+Bpu@W7N8Pw`gnX3&XIzA zyyXgi>+qX;q-BQ92RSM>FAVi2JC(?~s~{!D)gdLDnwVzXzPNV(@cPDdK<6AySn2gwW4z|Z%^e-4$lHe6#E`c)_TrW9*1DY(? zoALmCkf~$srzazgFe`#ch9V0O3|}4g-m-@JH&kZ=Wd`67@qcU#{>-$u|0pQ-=(cA3 z`6m!opeRxEw)5Gi9R_1yQEJNsE?2v(Z{8+jR_=&N&d9en!MD*9jKFfSXJJN~1;1Pr zc}zJJ8FED(EkV4MYQxrA9}m@?ur@u;Kgo^D5@9ad&{~oxzxe)vjg6oAoR8QpEpjE_ z5>o*Bd-yHg3+XUjIt-&gSojpnQkj)=MMLr$X^I^JDailcJCM8zfyuOKWBRg-6TpC< zXRC*hP&!ReCyvO>?K6(=B%(h_9TZE7+r7s$rBNPt36oWG%84?q1(JB^`})_AeBdEN z{YW=OHg4sxD+B;~q&N*nD7CW7+??YmztbqI;|gq@G(!Ut34<=0RZvgI~Liw zPrKo7dWz~uJL2V0N7gt3XKJ`+bM0f54G0^fxfM4>3yJZ#`WHXGLj{C^v>a>sWHcEr z$R8v#q#m^4#TYpe-D2!f=zvWq6HghTO;LnAO=2J;k(gp6N_y?^2x1%-)%~gX)KmtP z_wGBaU_2|t7|;eAl(r!G#%45J+Ms~L9N)&%nM#CdGC&gWto!&6ilqtQ_`M9|k>S3X zKs}68hqqc^r9-BBpR-nD)sHA%X26KpMuH9N2N8A7Go|nZsH2X(w3Mk!|dhP zWvkahl69KaMPD$Z%vGCBJgm$#$jfZ1MUanC39&C|$eebXL;12gsKTfCR$b`9`y@q{ z?xhPS@;|rso6baAjrj$T1wzeMgl* zNw)qY8NfPJvE5L%0cI(q$F0fFw3AjgF|F(*RcY1Bib%6*=erV0f}1!stT7dIsmh4$ zb8w#jDj`nfbm|6kMU17!WNn@`tQnd{SfI4!Cb@t9t~j!tNUt>2^;D%6rPpXt>5yo~ zJVKN1GJb$m+;29;c+UC-OG{@PyB&ERXB`QAG9N8y4JevSCAj4_s>_y=W5Bbo8vy#) zd|u?p*ZaT3Aojf-O*z=Bgeo?91y3jd`g;tuy;Ul=xRgV1`1YG9KsFY`Uwtn_8V`27 zWFS%a>tg*LpC~2rCSmZo3C5*1Cu@HL*cXx=NAX8P?)t!g7v6e5-q+WIv=nk_Sl=G+ z*&bWRlAcy^pSUQ*kg7T3>e^u=SoHoWg@Zxb@$y7mw88tv(YpXxBLbMIS##J)YQ5hK zjP?WFGMT|2&&R;hJ6wM+k*^~47ei`r(tafl=F~0|QhvEDdOHi!D;(dc)dJE@b*`C7 z0`!}zVdV@BJN9ea+ry7pe%ELPEJ65TnZAC71Dmy4EOhwDb6M+&RBSsoxC=QTxy61L z6_0KOLVwL{{E)ie!L;8xZ_D`1gp#T%@~yI#rsJf}%)Es^-2{u?^t2)k;-22qmfgdY z9WQU)E0n)yivz-gKP&rPnu*>A`_1_B&8c|AK?{k9kZ{%kd(OlQKvQ1@A{hQg`>*wu z@(&+Ds^|Y`#n~ex14)nzfFi8cTqyV7z1ajL|JI1{KcIjAcOfF8m-@l5tED?+U%$wx zsNq{r;O@NpJK!p4*$T_?457halVs+JP zjVkqtH&Qvl1tPJwd^yC7&zl+0s*F4Z*yU zTBRd*(%7@rO3h<0CG8VT3tct*)`7CMj>y6LHODZbu0Z(c&;LP|EZhJ z&xbhC8>6(yJkUgUIKPf?@1TBCQMpAv?|t{c{%QTQitl&}+8Xh<$y4YozS*ame2jf4H{8m3#G_cye@scruk*ozdmD{pzj zRp*_q95ZU`XEe_eIln){ZBmAjH}kDqMMP@BCgHPRubOnV`5GR%>n?a(clE!wZ0t7& z%fl9}E3(;|!YuHZZ(E$JmhE8cGpSpT6_l6!bxQ^9VlVI8$*i;}DfI+KkJjDH#rdbn z>7yv!90qN_OIv*UpzmSUw7lmu17QK?G443Oe~tBWtYo+?w$`+K(F#&#;5656&Gf`q zBKsUl4qV=-%;Zyfm==}eV4LJ^(ed(oFDQ@$Y*ijcsD+0zK9 zOd*4ZRu5a_W7E$jwLx}!PoV?n6APFMFqGb|xeX_(Io-W(TM9Q6+2az%N(> z9Op^j&ONl}b)r0%a+&(@ebGdsd#pVR>Et)@fbPbUF5QGf!(06tlDx zs1V8Yu~^{iSs%^h`D^Up(Wm7npqCrhne$D#kM|wuka`%LwREEslN7wyc4R-37M>pCu` zEUmA7bA_Azq6fytho>h~%hcj%_lPUth1;j_<&*&y?}LczGreKOhgfK8%OmJOh0o1p zgpZ>Kt%R6lOKbIV@8Et(EvhbMYwKc_-9*69c|@D6O#CiTkcQL~-CW%F97;f0?Z3pt z6f)M`gG#{0~W-^I_LR%n3)wH z7CyTmY<8dM70?mQf=o@ z%t^svpL_FYdf{7W)0>n^u4}ZV*L3jZNQT^_MGJTWZ%!ZP0Go~9a9ll;V)s74w>D}ckmgm=2_;pi4pQEA1Oc;7;LTB!S zrpL{= zLg+Ry?gT#leN*Up!mI@-v@)0oTiG-*A)VquJ@_SEI|T|elQheetU-i{XZ2lP>uyJV z5zrc|><(gb3Uo;6$`1eJyWzlYcyKHRJr6&yls)J3{?49_;^(U%F+-;5k$u6D=|5PJ zL3IK;$5llQfxAq#-NVC@kT0*0jF$tR+itK>hpt@#OniVdZhRL^ezu3q?IaIgx}HRO zm9ElvCvjnacT8vGGogr}L3>^|@L6)kTTImT_w7Wb`~6J2}Nz$F2s=HQ{qQ4?q8g_nGy)I z?ARtH#B%lEX;7RO+(ERSH(yWDmlqawg8#w`O4@ zlas4Z?Fe~)I{6P1JV{VGT0&wg`*0b7*Ll4i34+6=Vl#PGNNTAR#YgW=mQVF?0bqoty+D0P>51GZ2X#`Syn3&gxX6|o7Sa}pLFdUX z?A_lN%{P}th7b83t`DJ8WeKsn$3>+LV+`pbtW0wKA?u+YYUeli^o_}wG%=s2N3Ex=5Kt(%G=z5@1?c)e7ds@$`Go^XHuj)^f6O{FA>LDPpL-HQ)=tHqPTE?tw= zBkyQ46dqo~?GTSUy33PRe8auhTYpMhE_rrK|K&_oXnwB#=6=47CZXk;Q8jmr80r!~ zsR(7<$uT6c$!W2TlUvXGB~_Efi-XaFgArd!aF(+@dVLfrNGi2uZcx%)!_Cs-WbRSo zGKw!8WkHk0s4~Q~B+uVJSSm&coO2Uc>H29mB#19Lq$<(N5S@}fd?KW+dM(~3OKa&3 zR(4<|=o=;BqMS@~GqFUStP6u1a-*9O%4A*~>zHK^8!!jZ*qg>o_RF=f8(?}z!p$zeShUJE}ceV?&fu#|+tE z4({UQ;G{pHF+bB2)@ktHNWH+Ah4K)~_Wo!B^SNX=Rfp`$Aj<L(AI#ys_Xbq@AM}UJUik=`L(SzWXn1*raGG0RY$mf9D8@P~+l=f6z?${7;ym zYemm6M}h-9+E!bKEbZ z8OU@BY8)8c&UY3|>6{IBQsH+JWTC1{kOFc^sZtQ-|6KWmEB}-{M^ z2H4F9g*&d7D=L)~^C<7Wj$$o%r2@{&|Jgmtv#9m{=5t`8%$BBjHP5C+2xqLI=O^<^^LT$n zG8Le6nTMIT*xmt0iB5cOqzr>0wsg?=kWd{6ln@&p98CB;llbANc}MTEUWZS8&>RlUgwer!Ju%^$q~BIpJQ!P?*M26- zg+mxkfsH)R-U*SBc^wWDYOsq4M`d zp2irYRnCYZAs_ZjtTJ+R2K_@J`$L7g2N_Vx^_{T#Nk=MCaE~$^^Fn-iA6db<;_x!A zvVG{js_vvp8}EaYNFl^jiEzPCM3_oBd@q4___ynJBhsbwk;$_8WR}R`VqxfRKfHO$ z*ZI;;K8el8&fHx_tA?qrXW6Us-6A<9R-sAC8(f_85bNR&Q+`JNo@&pp!LtkrlANWx zZhYxs$X<3CXtfunqVnoz@WfotMMOhW%%rllbkx*<(M*XbM)2d=N8=C!S@%8_3xTp} z-n!b-Mxv-Ufay(=CEd`*d4^tKYcA8 z2$}4aHm@JjZS8iMtG@qX(E-~WRVl9t&GU=5A!vndZ$)Y<$eSrRsNoYThQYxlnCTa@ zTSeX7@uY;9WdoUtI4pSxGKJewo~y9?~s9GgVxQaLuMsMeq;3lb1eRMYCO=^PUxtC1#ox>=P@(te7?|c;lI! zPAVV3l<7A@5f)neHgc?_RLy)`)z@~$jzKQ&lvJRn?p;%&0Nu6>@lVqTO$(B-xAnzZ1^G z-#Ti$yDlcXnpzy!X9z52|M^Fb$bpfhv-@(UOpzu z0qGNd8yXF%$mM`(K(ATNES^u5^i?IQ6MitO6im9D?jO%C;W1M=Rinzq_=ybrc|K62 zM`$dFM@=R4Ve$M%7&v(<#jkj3VB3m(6G%y}_0vmVh+%DM! z@-&T4?-v|_bp*H)tE-)zodsTy4`{t8tf*;-dAf%^+%-Zx=Wght6CP{0$U0Kvn+6FA zk|IPDihhZ$JAWpW?r^%Bt6z(F&jeMRT5~SF^Lf(em|x+N62YY>?txX!1}e}_&uf00 zBp~A!oMTh?%y}_G@-i7M>2jBaqKV9(r51K==Mh`?jEspJN~Z@o`6lim z>9Ft{G2-j5l)G9vI3f{LD~4t^#G+tv(Cg1606fn>@Un?6h@{L}7ehx_VRug<-U;Y* z1@3529^&s}28ZL(N$neJ>YWX*opSbhLwm^NNoF;;%4ZLNCOo6pYu^VtBoj(vowLnD z53d1dJiq1VTHX1E*%rD;FLIiR}$>W!M8t zrH$#Y2D~vBi|Gr;x=_?_)(2n88XmM{KCTa49_XT_5iVquQ5lg@P~rt6IwA7S#U@$`Ct$=vO@0H%S^Ob%p8m;V3?}P}6o6~Gq(nwml)&y7f1QsoGjwWud zuM>WsNMc1`ZTdV8XLj7Nl$P{XrIUnu`?7-n$@>*wP|fW$DW`+04mVrgOwD55Uk+NGzmOpam;C14Q$#4$8BVm0zDEf6;_O$HR8^{! zH#r++jxm}(sQWcwlYOxOTg;jR!7D1fkwYqo8!Nc|1y!Lc&NsDq+X)R7!-qi3OxcKq z9Rz}u&*6JZElp1Lg3g&UV}=-Xld3g2{Hqxe8uf+B?0N(ls6rCBd7t}b-d0i1%yQxJ zp{2Z?dQQguT+U#P@B=gF1Ety0IdKL48xl&w`$uJZm`bO#*n5Kp4`%u=7CZU*JdVXb zjbZF6jPEU2aw)X;XkSVNp*Swb7}-&Icrr%XD6I1aiFw|)Jo--=l@|2&>%@-LtUZ=g zO2l4KK4QQ(5@-+9vqyAu)i35g&L3T62u!Kg$9E$l6$I4H?|P44jjxJ&*VouHMy^b@ z&yvWz%hL7@VLDVI`&;b^0JR;=XHf}V3qYG}JYR!EPg~g&wgcQEm~|t)3qDp*l$0yx z>=A=M{7}HjTDrz17YaiHuR$Emaf;b2Rjq_I4`d>$Xw<=>Ie7^r%5kEN1~?+|NO_iH>@ZnrG8u!zHfMOadG1A zy>8;jFXR71*ZAK7v=cKk=4NKZ&~O(Qm*}XaWp~nVQS5-G?gBgaPHguV@p$)jXh_eh zsP$p~>GH5i&(O7!&1Yx8@2<`ddcpx6^}=c^uiPQ0azF(=13!N{K$1Y%b{875OrZT& zEmvNH<>y|lS7^m5w@4tIoQ)^R`(u)4Ctx3CXBO=|XxTkQmx_0V@R;qf>nI6%sUGVZ z+fCkDz?9?7DY$M~#OLM3zl%FM04gwdArS$oKTmeGWcPLdsyz7f3KJ=y|HX~@ wkAnJtzkEZDyvEbh>%?I!!!c9 Date: Sun, 27 Sep 2026 02:54:32 +0000 Subject: [PATCH 17/33] ui: make VM setup requirements readable --- app/frontend/src/screens/launchpad.js | 11 ++++++++++- docs/screenshots/15-vm-first-launchpad.png | Bin 65154 -> 67891 bytes tests/gui/gui.spec.js | 14 ++++++++++---- 3 files changed, 20 insertions(+), 5 deletions(-) diff --git a/app/frontend/src/screens/launchpad.js b/app/frontend/src/screens/launchpad.js index 916e1041..9022aae5 100644 --- a/app/frontend/src/screens/launchpad.js +++ b/app/frontend/src/screens/launchpad.js @@ -359,6 +359,13 @@ export function renderLaunchpad() { if (state.freshVmCapability?.available && state.selected) { const vmBtn = btn(`Start ${distroName()} in a window`, 'btn btn-primary', () => tryInVM()); vmBtn.id = 'vm-prepare-btn'; footer.appendChild(vmBtn); + const vmHint = el('div'); + vmHint.id = 'vm-prepare-hint'; + vmHint.setAttribute('role', 'status'); + vmHint.setAttribute('aria-live', 'polite'); + vmHint.style.cssText = 'font-size:12px;line-height:1.3;color:var(--text-dim);margin-right:auto;max-width:200px'; + vmBtn.setAttribute('aria-describedby', vmHint.id); + footer.insertBefore(vmHint, footer.firstChild); } if (state.freshVmCapability?.runtimeNeeded) { footer.appendChild(btn('Set up Linux in a window', 'btn btn-primary', () => installVMRuntime())); @@ -411,8 +418,10 @@ function refreshInstallValidity() { else if (!c.password) vmReason = 'Set your Linux password below'; else if (c.password !== c.passwordConfirm) vmReason = 'Passwords do not match'; vmBtn.disabled = vmReason !== ''; - vmBtn.textContent = vmReason || `Start ${distroName()} in a window`; + vmBtn.textContent = `Start ${distroName()} in a window`; vmBtn.title = vmReason; + const vmHint = document.getElementById('vm-prepare-hint'); + if (vmHint) vmHint.textContent = vmReason; } let reason = ''; // Preflight safety gates (#63) come FIRST: these are conditions under which diff --git a/docs/screenshots/15-vm-first-launchpad.png b/docs/screenshots/15-vm-first-launchpad.png index ea9af3701e6c6c301060a4cc8f24e35f67c036dc..827af6fd89a7cadb6f5356f40afef61961c675a9 100644 GIT binary patch delta 60105 zcmXtfWl&sQ(=8!^pus)3ySs(p1PK=0-QDE`cMm#9upzhwx8UyX?(RNwdEQ&!`89QF zYFF<*-Mf3OUOVvheQn~0Dg+$h@g1B6*JC;9>>XY5gTZbsa^nN`X32aku=I^470>u8b4-m7Ra!u*4@({@n9-c~|#E%ZSe~fuZF25o(_%}oT-HfO>^5|IV_Lk^4Fw#!x zYd>9<3nmNPyr&##+i%hUI)wICumyO3B!oekbv?$#1^s=X4x)q+&6ZbgmF>?{5B$CC zNG}d+S3+toCvkNEde*zQWpnqDkjL6pS@fohNc|TEZ$)!ml7=)=!(ZbR6k0sy4`BHj zimn>%d8R$KCw5A62(Z!*1>)wo4i6|K^<`^1epQ#|_>7jdTrUd0vh<8DKTI5Cg2ys4 z#{6rOSR!R3W#uAwDgN_g@Sk%QzWhN4zx!G!Gx=6vJ5b)?E!J?7>qhM&p}RAaB~pL8 zyWU=-vwJn(uUzJRksCAo4V&GVg&4p&ueGs0D&v0`!@Uk#Uf07DY!6rIWd7Y&8G+Q$)D; z;9zdaoed@CKo@w&Sm%LCiC-Qe=2|<6y#dZ`$?fnwHS&Dk9^Jtsi$)jF<*aGx* zSwsXG^{`9-LFKL{Ix9UCtL0idTo%h4SV%cVqQ|hPN12r}qNKe%R&Tp5uRWU1A|^TiE7Pd_N}am`Cjaak8EG1{o`y=7K_nZO=7~rjMvGn zhKLaFgaYu=-O*a@dyVB1A*aA#kkTWpzs&`@Op9CiAwSqWi|i`+$vt-DoTKy?!hfGW z_we~}u3);3TZh-rbw$hfKIu687bZaIpzbv_2Ub)bjM;?@$a`!o8njjAOG(Gcs_Z1Q z>VPNs%eftdAYV?8a)ez#f#G8E{rb>tL5Zg!tFx28jo+uU=M5@nXXiGo>is!|r4kyR zEXIYSX_F4Tj(Ji5PhShs40XkwOhxb5u>;Y&PQjeH2|S^jo+DG=z(1yLvcSlv!l}a( z(Ywjxfkodk#P#>YnAG%gJdm>{w+ErEU82;E+UHxERwWg#nhXdS>_5M7n{i1mz%`%4 zh(%2uVcGv|bN88(wF7q?Jc)ChLbg_J9a z{=B~@_eS-5JlYSB5;)8Q3h)JvBp~P?fiaxHB;&*R6F~jHjZgB`<9;43EPt=D1yBE8zH?1C5hMgOY^)6^u9CrbAn933g`OW@bJw*Sbhc_OkC{cLrCz zG&r=oDUnbfM7aWI9*$_WR=xhO{S2^KQ4g^oY4GH$aI5QMOr@RwrMB`!??Ddpp>nN!u=Zf*Q)SIZ)r@`uKS@CI?d)k7BQA~~ixkfC%!-KQ6?rTr`qn4) zHw6OL&N8_nc%guOvkyJ;>#>Lh*Wwjzww83|YTL*2Ufa3NraX4ubm}~^RMn#H_h=O6 z82hV@XHqj(?iqqMilE#4)%?g^kID+q!qAqNi1l*ZT&+E>`};U-Y1dP%abbFa17M`> za&8x|Loan&sM(-3F{Xj#c%?*j<$7g&FBa{$D~>~JRsIesq{S*cRkT*vVLSLab5lU% zWtb*!JWUFZS@VA4DvZ<{TuI}Y#3>Z4{)>rpkX7KxroUkR&1e{Oj<2UQe{a%SZBkh~ z?&fG|Gv3O46(gU&4P>B6elvM_|mu; zulRqT0EUb!cn$8qcQ7!bhDo_n+(~g#+`v`aM~j*8nO*91cCMQ&vdgW#ilLZId7we| zI!@ zs1*!jmf!v5#nPOZePf~?m2^HZ#UBAj??7>)V}^Y5Fpa*buFY}{W+dH`yX zVx4x|g9`(%m$G|s^PSprd~>gvi>ERIdG*fXqOLA(|{!LGf`c=3sze! z`btYFw!ca>UDlLqN%1=OZS=zLX40n5|5dm&@FLB|>YVEH15Is~Verm2++F?G_u&g=4mHgMQ6eVngVQGVJ; zN`tZJ(R!_g5zBn)4ut-;JeyrDUS>=e6TF*Aho`dqhp@bABkTa72DOceCd<$8G1kW- zE91*H6l@L=?;&;tFB6i+7CSwN*u5LbCN$@$N zSkK_vqe!djOga#O$eq(ry9@9UL30j{3HU1rTm>`V3ovX$m&_^IDd12V>gJ<2iGikh zgughqued#OV`B=PDB{>WVN$u|Iyp7vV&~%m3JaePZBwx$sAbYXOvzPrB>mq#Jf!pc zj?BaNcl#DItdB?V6LJ6$QINONsd`4+ukhBU!{{?r={gxQg@H&6Buy?33`zG59o{TP z0ZH_vOx#Wc3kwz;6MN8;TGWz+@ojl zt;2ZHswo{);g!5D3Mw@Gu+lgtH8LM|c}!2NF*!1c%x2h7^>94hCI*U`->GtKDz!Xw679hV zvo&4_UOrv??`&`hE~8|qw3Y2pJm6kJ*2JWGaN_U?ULQgqLRP6IIGAxN$62?x{SahY zzxl{d2!xWe@MfBlm?Kii@=%kY)fDg}Vx+|OVZn2ffSeouUarQb<#yz&vw?N6&Ue*J z_t{X~>J%7Q1%nd?yD@zNPtM{!$xmhX5sL$EAp7?Ij;0Z%f%MOR-hju^&&gp7)ZmmZv230j$v z>ReX+)W%kUnYJN4OMY9w+!35qcLocK^?gaQ`ZknhBvAa&l+RHj(xO6_E=b&uT(n2<*#ONZMm@EOdl;N&NgXY&CHaU)}FPh z0qoW0T+Mjt>HI1#a1bzOj|&bWirsQ{A33Y|9~p&Dv{o2zJppOiB2kgNxl9GUPNV&1 zmzx=!i`E`Zq5IAEb2lyS@}=J&Aug0G^n~){`VWqB-~NORVau#h>F$#@{c*ZJFAe z^o7QQ9mdK|zL!X+otj*uYU`0bq=U9x%DbcuuIF|l#@b`u_{B=B*y zrFhTd=5JlG<&_OmjVj%fDzP?E202xRTDG48tgM!SfyFLpYBoZ(rS9*T0}K^{!HJ1Upzo;bxV%{Bcu$TBWvAYH ztWgsY7Jks6p<1_6D#&60+`t^X0+=hr1rf87RUnYF2P4|1YI7#;2v)-CW$05w=<615 zPCXF`JWD*cm`LWo+c+4qeun4t#|@x;M2}*`^}1DP)6Sz3&j9<^+Ux}yza7pR*^8tu zQe7tb!NEJ3Cu;r02_rG{yN*iE51j^th;6ODu zt#FwX@qbr@-oy_aghcezfy83lD#YIJtJe^#|IBax6UvXf>_JHW^U2ud)AGS3h6_qd zE7KMRgkkWMPjH2VsNPtn>o-MZudSOb+=G-PSE^Jgt&1wPF0R%;$Mmp^?y7k(f1&Aq zUja)p=RjJW(xS7RT^5B1C6ILC)*SkI;oxk^Rv$CS8By7Fq79Tdydt_I7ny7It8L$) zEx_YWU-cJ5Mh#hZZoPx`ELOe%67P?bx*JBHvVg3-4dT$~@EIGtf^1O#reQo?^u{zs z^;Z;^==O6G6aZ@hC9mc2gf>8e64yNSS7g8K!cf=osL|rearR)#OZQ3DZf`+Nl3>m?7+>PRt?_fWw=voL12#4@!-J~? zwZ5sugv=}CK6uDb_43c6V7+21Nm#cLXAa-2JLEfal)g;_M!$2pJ-dnKGJEjjy?LZv z%(_D>nhP5XjR?>ceetVA+abNW!T9eE3m!>jsA_z~A4j3VNa=mfl)AUl;<)>$Xx||b zfxba3wa-C{_p!DZHP%r!I=E2-H-t7tN&zzy!!Pesqzr@U0t&>(#WQSF+`gVF<&+!W zc6wB512iqrRj7hkjpOUWo)2<4to33qz-%N;xEmIfi)))6d%TlkGs{{*S7Nwi<~(I5a-Z0DFPT(FqgqfN_ryAe})a z6=`APJ;KS&w;~vw8cDp_L5?R$77=9@BN0Ls%EzmI@Pn7w%GSC{azr6@Z02=pKw_m# zL}mRno&k_cf^*&B_{06l{%b`rad@y)sb$S!0IjW8iS7`%I$ZhX>s7oIFXRrpp1f{| zaU?NHI#R(Hfnwq2pNJre-w$ouuYsAH2a_M08H-ltK70}%N2liD=T9*|xykj_TBm-iIRq)#qDZlx9(1Jae8g>5jMADv zIRUh`i!RK?Tk9hK@#z8|D>;|m7GYf=42}%Z)1gW)#Mf`jEPIJ>>4r8xNqIRtYZZ5`v)k38+-7s=Wc9#Efuu}E z)esVLB{{VpRqbpjC|Eqc6`0zEnRC_j9apcC(bLm?lh)V!HcS4#+4a+DG0o7*46s64 zq;j!pJCBBn467xk()c9?&oV{C&4x+wG}1hm9%V%=tfbB){J4H^xE~ft!#F zVxSm`L`7r|4mU~TcC)jdwuO^_YgyZLjYk^R7F??{B4*a?>wX=Z|Kq@yIQC7~DHsf2j}GI@cQK_qNip;{_n|=X0Z3DsbQW z3APtk3atgab)bTHea4p)OeR%n^J_KUqe}L&$<#Hn@-%sqU4Q;oopZ6EU?^5D6NfGW zek`TqYjf*$r%;}A$hl(JXe`Uxy=JLKzkcvi;!w` z`p*H#SD&^4BNEENQlf*>=Xr1>T0Kd_qV5~!YGAg?1kwU0Dh?vlJQ^Vy@lYlSC@X z-?QzLW10@L1kKCWlOF!4Uvr!%DhVKeOVf2kj^v>)wKOc;m*b=zJiO#sqE9Ma0|?Op z8sYIhG2t6#m2?$?y21s#iY}e;C9?zz$Vk3Cf&Y#rB-(#PDkvq``kZ4F`$hn%T7g{$ z2)eOs&2bsno!c*#S~Iznr_ExFurNOtd85)f^-X&i1=q4kQ%MyADSOmH{bGmCRH3z3 zV@B5@AV_@qY^e$B*9l4WvhV-at`}MJc8)Q2KML48)Ef#Y?9YXWK1D5VeR+e5!{&@G zQWOc0i<}OY!OU@TcG}ipBTYbkwwh9!0hFN_C6Qptf!Mub0p-dFP%SFS&!bX1LMuf3 zg)4<2iNHsnCoXvR?AuPimznpY!vn7cFN*V96BRBjUZ6%Jsc|-v3wF3p{7<&OWuue-AMj3%y#}6ofo65~{nI~9!2UH(&gYq|$$Uow zQ4_08;W&oG#(^q}{%$l6_`dsKiyi~$^wn}IVqcs(sXe3&%$ffpN(z=WuTo;kplZAx z{1|&Ga^MW#!D4%)joMXg#W9VY$9`?%cW&?ZWVm!)8K?HEwD?LxbY2g7cNFsH@R0Ph zvLQ1INUA$I)gfi&0ep}9K}S+WPR9OEy&1cI4$&I8aa!B#?J##S@3$(7ND>oSTk(Rr z>$Q{2228m@wne%XH9L*`lV4Rds~%9MPx$ZpY*1-IS$|PvJ8u_x*9&EySX#biz29eu z?2|K4f7qDzBEaMRw7vp;62>{uI3{7pE?Dsdde<&@URBkY1T!HctQybw{Fa15_Ah^J z6X#Eoiy+O-=O+lfeW;I0ZN!{0Sxz1=xy~(=#|ff{>WA^*|`&iVm`01e-{pYWPl_6tE=V!q7K29K71tShdkS(rAmG5HU z(0r_tZrG;hC|CTWs^RpU(h$i>RF4@x_=;X{?ll|={3_7K15|U zzvOhfAe;hUOrWK_t{-yK!UNHZGVl_l(VYish7O&#sKwUHzerZ2)G2_n1%a0$ye3vr z5Z5W2H{nI3Ld>`9JmXa6k@#K9vEfIS zpHFPtD?$Cs;nh^y`L@3iXAPbr3a2*lB`iyvtb`T^$;b1RzXGdbft({t#hgR6ByEf_ z11S+xKVt5Vnp{_x{WUHx#qz&VH9_L$S6hC5GyUSWN-An_c}cQe6_x1^Jz9q{m_MwR zLo1sudhxx2vWKf>rUPOa9wL^*dfxPR1YXker+T3OR z_1J@Ji2pHEr?>4OQcpMKjJp3fGADsxU4oa>Qy;vM)!g4cz%4_`)&JVrV^oBZW^Z3O zxyd~LXGEB;k4{6!#IiG{61j3Bq`_8PZuprM#C&iu?LgM&<`oCv^Ji0y%oTJZWw9I#?y_=mdtQ8DmHr~SR?BxDNe=`P|Jj-Sy;lx#52}IE z`n@1{ZAGzA1U*CXp)*BVk6d3{%+QvLTb)Vq<{zhDk$W8P8k1otJ3XD6*o_0`U6Q&3VluY`pD&A4>b~2 z@?l^ot65L!OoWW_@s$@5_GPx?Y>isCmS?c>ba1uhz^em7)ABv|*3Emtll7KL(((3q zY^Cb1H`QceKMj@O#{-nUAK_!hYG1$s+4&K!Oq2A+pZuQ*$#F~sdnCzRH17Sb;N zK`VP5=RVjm@aTA=VzgE@vIXKJ3Y82Rz%E1f3a+`4qa*QoR<2$x>MeiWcMcBC5bmfp)g-oTcsX0Snz5%$|ZR+qw6%L2TsKkgM)TGd1LVVOM~&gZ0m-J!bVyu`0vJCEM^5Wxw$ zY(*4~XiH5}hUKNB+MU1V6;_u4d=6J-_3 z=qZ0o*L;+S5pvllBP)UC?{uwAfo3A|c&#uG$xOp-cYW;8*U){q02X}$eC>s2pQs11 z#9esUn8Lc_isY{v_k{!idN;Rrie5UK}F*zDee2WvrR!ee`4V7ueI;m@>hPT zo`>(^iX;co0)2hJhk?MFYaTJv+kq`=Sud^W4qH%go@WTrtEfsc10(annt_!Q9?}?# z1Anf{<(54_ClDEsmo0CjwW>Y65gXT?x|J$IM^nNhi7%;fd((WKN3%?)Kj^7W`8NMi zsKv~zZn8c4)qvAGZJv;j;8_wqj^;eLR;*g|^c;i+*iE^0ye>eJ2%?}hCsm#X>08%F_-JFNGmR^gaF^X2O++`e1sg!pQ%BMe}!)HM&vfr(SIY08(2np?aOayYd=2u#{aSz(Y++aFl5HV1^l=? zO6oVh6gl&!RqxyXXuj>7e=x@Boyt8RftI1@$m7;~)hI8~{KawaV9_R~L!ai0eR>c% zWAvG?*BAA8IzfkGM3b=-)U0Lb#Hxx_9eNG|w!wxN3M7!$Oh^BZ&*3h^FZw2k1K=`@ zT(rQV?(R27Jioo%@V9lk@p0Zwx(1gCAMoiV1AUS3?1^q}6g>KVptd)VF*rh(*b;}o z&eIGZx4a|eWNU8-crgVmn6P=lesjX7B$Y!VaTO?9`Vb+h#tj2A0@gwtD>E+zZRh3{ z$98_rbsS8jc5-ss?=Wpx4uZFk08H=H;Tkp`i;7z1r)-71{&Z}Ko~sLSbL9F@f>RnC z{CqnX6BKU>wj7Tw>~5Qbr;0yCVh2$8>-Sa9-yNY0H{y-qPagVW@IJ?t=B%^TcMtoL z4fM!1`lY#D5ydDL{lJ*a^4J&!Z=%{j>&W+7IaIqsbWPcbGU*)a!0Hwx0N5qsOJ{`n z$nJT___0d{6NyXGJ0)AMiw-t{Sv*{+9dmq&b8O_P?xd7m=Jgf7FS`;=n=dH6tfHFw zd^8pA+-|kZeVpc871AI@evqgO|7HAZ>-mS&u~>}Nn|-%?2A0gQ0w*|vc`Af8yOMKO zx|rM+w2TH_RX>km1p&Q)zF1tlxxjSidHC!!>EK9oR z>cH!|PMX1PtFWvXmMrXWpi&U^Tg@4i$bji?PDsV;*B`hVL#w&>-)dJZZfGIj??*|S z6B}sqkc}Oucxehcrhgx~<(DDb!(ybfaY^E?9=mTGOQd!C@z{i=1D}^T^(9=Bn^D{B zt!dok{o;!~MNXn;&kT@6(`(WO9AV6!PD{q&_1NUueLkaHks@1_ zAxjJvJ8RE0D~SOpP&&6DZCad{*5M^xTir3h$nGtk)e2I|3?2^KROekRoi0`{dhD@S zJ$Ryy`xr5T5EvcoYB63B1W)lU^nT8cC>mO9J*|m#>&Cy zFyl=Qmh#$;@srAU51*&;aa3oM6uqF>)*tJiWqLB)Mish~EYP$3)K~q&dy7=_E}GSO zPVM`?ZP>0Y7yP2e>0t|0DA-773y#W~L{&;o%WO7w^Zu6RP-0!<_M>?__3FZ~cdf#K zZ_^bkE26pv2z{4~s4!?Et>%>b9k>5Wn}s#Qs{wXc`EziHjGSb3FTEO4kh~ZbI4#=B z?k>XYBJ=UD)w;CB#pmQU4TD=}i>M%+oUesb1iCwD1vJY&A5a)*hfEIL;J4V!KZB-9 zH9+D2D)wUD-7e~}rI+ekI#|`Z0W*I)5;N5L2#7qK0VLB)FsC#Fv3;vrOS2FDR@5OU zD#G>RWr@@qX96;(b^+U3H<*o@Bv@P&mFc~{`g~f7u1Jd8&ACy!SP!=mYrNe^y!4SK`laK%5Y4?jhkUq$)1Z~}z6q+k+GiB;w4DC-^slWL`(6Y+h}9CGcMs*VlK$aV zj~!1R$jvca+*<$L?eO9|Z6n8|%QB#;eKoC{K(#=A+XekUvY=;!@$aLq=d42g9r9es z;!3eA&FXi)Sz!@lmGeg{C~3B@Lml9XT}O9*kA`lPY15U)DKQ4QE@!Ryn!3etZwy;1 zEMH#aS=3A`7!&JuCRBesyJ~S0o`VI{p1gq--RS%lp^u&EPCAlqrsLKhU()RW{Z5t*3r+%5l445Z|uo?tz}P(LA$Uo)YmV!PBGY zABwjspq=~hL{f*FIH??bqL@B9@Y>!f9eyP!(7cQjjgB&oU!A87H>mVtX*PeE&EWgE z2J*U?_e`Y@F+i_-Fi0;f_5|AHG(F#Y+dQUzj40)<)N+K-&=?mwpr3V|{!8j0ubA_F z$o|DmbnL!b?@)vof$X_8si-2SYpNe<&!@rwji$$Sps7OIbX3h>d|`oxa~{t67d<(+6G1I zP`Cp^StSkKgBMF6PvgQD%L;FYJP+e)#y}2m=GOS0Vqf6F zR(`lwjcLiF%4?K^UGQrx_>vN2_|(N#4n7_xI`@A+We)T6{GTnHMR?=V+N7p>Y8&{M zG;&c`$QfJldFr5rpxx=?sh#Nj9h$raWTI^L+j3MUccCsr6bVm|#;v}c{MsgXGYa^l z30if#DYybBCt!!-Cu~UFaZ-+yI}_Yjblk^?BxAgT`F8^9-9WLJ`E>R&UNrK--&F;L zFju(5ZVBjhzrDUfXbgdD0?u0N)K^6#EP873#@H%pW8_yLmx;7Lc_ zm%*_AECc(YX>fSsdTDU1nRs~(atYW$4>ZJ0;b9(PN9-L#U0PPc+|MdYE4M9Vt%PU@ zLd0-Kw`y&K`b>s0L|<-rbqt^|E={cNsJY+&|A=6?QuD2(y)d@w+aPnCV0#V_Y0GR zs1SU)|Mz@{N(YfEb;;GuBug6K`#Nv86G?=Om`G+uMSVXzcYSx;ziD{XZ-f1yMuDu! zjE{f8OQG#qEkvJ4?A|T~Tx2~f264V|-EX-g|Ik5&$W~thr@#QjY(ysQ@j93UADxy8@;zNibKE(y5%SVKM`9Ys?AaM8 zq`(c5`bsilL@>qU=2}X;#=iVJ!gwd0JrDs(qstN|yR5fd&TX`BjxK|R&Hfc5O6sn8 zWdJosMIwEWjvg9Bby3)Cq=bVH$ z8na1}T5`EFnc&yyA?2+gRuaBLY%8dh+jk5z84_uhZVV40H0N`wsop>FPtY7}f@@l- zHR9Z>T7(bdDqpn@0?hX3vq>d?X@6%idq6H)QC+qXXu;wFE?X%=qQBZ6%oIyew>x19 zy4Z^e5TV}BpPg1kV8ay}Ygg%2*JldN@@d)q=R8B6kso`}mf7DoR!W7cFHw$av z5U=c zVfNCc?9u?zlTsR(san|#$q$sZMq$X4jn(Wbojn|$#5~9Gvrt}BH^Zcqh@s@3T4@rO z5X^VX54QHD;4lPBONt0Xt{Y0Hi^t1RV{y44Q6x%sDwTI8e=ByrN>zDxhT3`N(xc#N z&?qp6Z>mi0SoX+CA=AnlevE3Shn39yDdNOH!V3aEMyxiVn&hk6Qq~y-{6l%$;zR7H z;$AdGViCCN(zCnp&{Am9!F_95hKnS1w-@a8m$sU!=?X#U!3ot(jpuIrkeoqBI}^l^ zD`86gjT`b8{Ttml##XIom^Tp`J*uJ*3}#U(eb44eS|*=x!W@M%1)MF%*H3oa*)(k~ z1(pDIiH9!%o4B2wNyl+uNFE~9R~Gh;VaeP{eAw2X7JoZ&-((inwG`a224A|SFw+^3 z1b>WB%Nc*Skuv7Y6$<cLW;$lM;z^#sd6nivG_#lRXW*Cv6;-Qmw-CR&*d-Mg8y!HBeMtKng4{!qXByjX zukd?&%x;#)%C?8HLbI#Oz$BbX;wJP>OYI*7VChG-x2(#4;M2`rAbs=ZqDr~W z^&yAvkVS4c1v}yG$dG=~lSvXOTzzNNc#b4ZSo(yFEA8jM@O9l~;XpW6Ku1Hcv!^tPZ`B30sQ81IGu4#kVc-MI4 zP&lqJBRZTmu_MHgCEU_D+2A-Cbrjt_swftiV!z~tV};gIYax1%F6t{9le|`!AiLQl z;;Yan{JGYwvnJw+wsO@B?jbdyPu??RPx@9gi56A(u!l*Zi;^n}?1Cpzo;;$)l4T+? zLE`z`f_iKIZOrtcz34KMT-^`GhTWgA6?=+3p=Cd3OB+70Qc-{18t*m|_Y?orFg#(Q z7`~w*p(56(FKj=NHa|CCu87`4Jy0m{zX*=!VtmzMvB?RL8I6a#%EUh#Kyby3!P`97 zY-Ot)wdKJ=(*&HGBsL6!hf?T_U-B=B_c$dE_6Z4Vye^7Rswr5yIuJ3XGk>E$_=t~+ zL$Glou*jp0r_s$hQ4W26*`Y$d#3Nj>I5)_8M(=j`CPsfuK*nABp2%{U%J7vgHq$h2 z#atn0v;%qYN|R#O{KwJzVpc*79t<>m#Kpp6+?3@02OmJ%3PTolZowJDWUPciRCHD_ zoV71;uSfDj2iZ@KsfcL0uCBz8V_a<07;GH0ce4A*B^|QIUr++V-)8x55G2xkKM*Fh zLT7PQovO;RW~Zsf)OH~>;gXAxP(WSXA-#|L-C6Ehv%kF+N-B+vzAlYN(}axBZk>C* z+w--OeiG1}FB_kQBNh=otVbNg-}>u|0bPxib<6t*b|hAowhw4$Y+;K5G8qI*ojY`w<^$Cg&yN{z-znDn?$Ee37fJUWI0glpwPy$$`C!%b}h;#JYO=BLwX zsyn(I-J)D$zY$%(CE^DL|8vV`30uVZgNzw8YPa^_#P_4HO=p%_6EwvK{>|oE2(ab2ux- zeXa_$vf?x8ah&OYIpX$i;~$-!&o+X+9N_2EW0xFI^6&Zc;abKC%~@6)JGd{gt-G%{wz6yY@Y%C&8RW4rihh4etx|)sUVUL!^#PxBn5HaHFhnLvwIG>Q46y-?YB~amJf$N`?-R~<>^usmVc+P z#2UTvlyA52ezW05h5h#n=8NUeHRdEXsXxF8GIIX+!_OSlnG)c5nO{|G;Rx?wrnj!W z+Vn?`JB89_PYLh5R^LPy74H9OV@5OBFq1nmRjoGPUa=67nY zDguL%L%zNx>GbdU=rOTt=M(ifFn+lSpp@WqUKyJ!1VmQjYMOEdc=;1=U$1Ed)&Aha@R1ww6w&8 zYtxd`Y53)>>qCVNAnT3mHln4ag>K=Ay77Is_dnHPx1%!=N+u9OcnV%BeN)-ozQ^)xzYe#VA}ZbTf|dHU+i6E!X0PQble?lqA235WKbQyBLUc^ZMO{&bz9E zpVR>&3e0O)w7m;OFTXF!lda44Em*v4j+<UydRK&tc~=F`rlV}V7%!T(v&-13|=924L)rWP?}JF+r72Hy&fM{IY?6+gHhe|G{0O%s~1(7;|l1E-e$~8~2l5(j*z| zEr^8((?KTmp&tZ1FRznXz{8|DjgF3XJoIh@2L4U&M+4J8gMd4Ka|$h4Ib%<23Y@q7 z$q&nbi>NOpCM5%k)U+><|E03%tt~CVZjZc8adJyaN=i#@CiAE*aYsxYLoLQ&(L7%Y zg82?6KERBmJZNHQ#AAEPQ*Z{2B_-stfy&>a)jX`%SeJl+gnOn`s06G;N;v~XwHW`Ew&`yTgPEMVit>xHliz~F|4hW|zZ#GZ~RDJcQwo$~M&M)~`d?QFO!R=6;1J{P!qCk`>e z3W@w!NFk0zT5pJ}QzuR9sr)?#LT(a<8+nqb6caEY5Bd7fqh}xS8ihP(TzWH~?ID2< z2K<#GBw>*1#Q?jcRX?YHyB8{{fvu9p8hF}UI%`So<(I3|2BTZn8-*uw@$a>`SXP$> z?UgNU6kK0F_NK3~fkNKXap}J6Bp56&#|^R@vtqCs3`$JqIALt+#!JJ+~ntU4FUc|9o>3=|I_S|UdS|^m3r_CamC1F%JiJ) z5_(7IvLJP}VHS2n(0C<$@lR<24Zr=F95XY-ep#WK_iDLv`$lwabsDlN8uxUMP9<*qRTB$EeLIeZNMTUEtKqmQtd$6&0NBbsEU zP6S-JAOZE;uCIsF$(0q+5?qII2IWFAqOUg=R$N?^6txb1kgV~z>=N1^E!(>q9_VPX z?T?g)DCMNOPKk*-2OpVS-9;rhE$mLqT|(_AwYfM%nt3cNrvv^pbl^a*p5A4pQ|uUe za>`WaTs>tLut}+&+Kai?Q^{faNsjj`Qr?#-nUgit zH5s4t(t4{eB@}WD;Z-n18dH?{EH77n=Gqvnym7l<;}lJdWK-`AV|CClL6EKN*axZ$ z6G{>Y#xM<_4_V*Lej(%CK1<~$uD_7J50muO3F47xl4W6tIdjj&XIDAw_D#ASks1T8 z%ID8zq-6{q!&*q53x-23zS~@Kp10qb5Qv-(uiJY*A=e@M&08XV^M_1iP_#lj%Tzuc zwalbQeDL3B)IIBwJ?o4F+S}T~5`p&3?2nNYBcncRE3PUrJ;-NGUWfu0^9_VdJ@TgT zVWT(~TgZ47S*#{oSSXaIgIbxbM5G;*$%0OGl#k9x((#!dqa`><1S)nuk8MFqWaT{` zWCLe_(pPqux%Kt?XXw3a+PB*g+UoV0%Zu!E8<*&FQcT9Wo47c{hMb-4YI@Y!wVm5V z`tCQ$zQ_5KbAQ1x;rdPvDYoBwSTLKhq0_=*2P56|y9)WFd<|VdswHvIC{V`z@4xF7 zW~U@>iAa3jn6qI8SI9GPvw1SupNUEWxnCDi-a-pDi+k~vq{vQzd4}Fq zR(6C9ph)AQAfUh9 zpY55}1|E-d{t7T>ZTVeEmxS>Q?$dn28!C5DZ4*?w)EMQ4{6DJRIxKEz3-_i%DXxX$ z#ogUo+}*XfyK72;;?RNOR@~hOEACL--Q5{{zUleyIrq8wZzjpkPO`I-wb%N+%RJOg zWA*3w(fPf;-3@d&ys=fsK%^Jx!po9VWA_TmLv4>M>1L#u?9X4!Y4meiD;WU9R$Z0G z?HNX(d#K<7P(sGaL!Rpo0~vqyPwFWGit29sm=q2xraa@Z1osauCuqTqsg|yK$+zq6 z4b6lU8<3)Gsu0_u)sbV?D$v`q{JmPMtv9b~!E#_7g%lMttIy53xC?o;T~zEE_65Ib{%f_Nf?%x^VA9RitYOVxL8?X zs9K5$Zs)@LR1Dd-KjQ=>YZ8mV=_Uwccgo#+!f zK@t*dbOR3jkEv~sJ&7l%x{}M^-I2Gd3r?1nn3B7R1JNal|N9Y!tMf9@eZgc;Ox(tV zI{LV(RZ`{afKGXs>_!c^Z=?JYHP2e2-~F6GMFw<(&;BfY~3wc z79pq*lte^|6=LvpR_@4KJf4NuL3?4R678E@cNB|G!oqDpuFo8hMp{yv=VjSBFZW7P z`D0Cvx3`qA5MiAPeDNGJ$m3Xb&hMHnm9XE9FjZ;Yy8gUX7@U)g8=|hDvb}UV?0T{_N_jMs&1!Y6jOSvZ-I`k*6<3mf>Pv4dU4^w@vw@HK z@b4>rL84kWx_(rk#gm?)gFo9N)8E1RguUe_h5=S&Nr{HL5m;Wc$&4-Z=yL;F~;;_Asl;^{vV- z8D+*8j@v;i2TxhC+h$1rVD1qsi|UdairTv7EG5bgNSni;Cw4s-izvqhs#rDJwj!b2 zx7Fz%5k-W02?gmFN*k5cC=+o%a2W3A#f2w2e>1u1Yx{Kk=+DdY&Y)uAc&P_uxEy zd6%3MTikl>;-|6{pfLtLpL-DAK zRLN(GDyh9xF1E(}T3nDvveYrZaD4oNH0yeZxeZwQmUz(U`DIPUg%;#%k z(#n8buX2*7BNz1jHtM}k&gRme_OjA?RryWx%sYMg(N8Ydf`Ym*DL*h9)PIVw zQ8D~#Af85jHea!PGo(jkO_`bP`uiuY=t-`l+mohD%}qjO?iJP#2_jE_76z_GhZ>c0 z;gB4&;oJD{HJoz46}I^p--Sn|*SJ=E31#jCnlcs6n&hYpqYAplZcHDj^;KDKCxh6q z`-DRrWX}CfB}WZ>ua@igI(~btD@9E7|0=p~Z07|=BGo7lL0C17$@{juRhc-j&KO5wsK3nOoM(j z^ChDXW`18KwQ8U6v?ygFH8NZrFe*8KTKF#!+#C)&cR80^bE;t!_Yzp;e7`H)B3lIauEpx!k zsVg4gL6HdP9hduCr0Na(m|E0HG(-CjVE?SAqi5`rVhUQVqkh2a*wJYADC5q=%WPMD z#{VU>KkK=5xFcC^MHR2f0|&kDTtBrvze3=z<)VfWdNn>A8FN%`YIRn|9+ISkQqA^{ za=(9#GXM$GoF zUcxgH`>^C`{$GS zbz^FQLl{Xw;+)g#fNeZ|R2!QT(LLt-HKE#t^dv1el}I8!7fKdKv{b;F>=yZzF=gnw zg_uo9JP^bZB|QM$H%<;sgV6f@RC z3uW=vt$F@9yrIOdFoB_QpmP$fHG)3!hP8fd3>kG5ToN*N8fudEy}Cvo@r+=Se&yJ9 z;N^8eKRJ&lCV8~}y*)r3PuSZW{(aO8i|`d3^~QzQ#0T=Xkv`y9k2TvaiH`6JK?QV9 zaYXXH&MB0={T+yxSlux5-LolYC~+Udx6+<8#~0FvSI8MF=qt7|LL;1}L(FltNrzTF z&>ONix(#Bi0?5O$CcEr!$}eW`{!GI>r==6Jco|C7eMxjLvI}5fVQ3#>rnZC4Fd!C2p~9Q)4;ap7pfdi9pgM!o?LnoKdZ!L^fu} zU0?6se!r{t2qFEPO*Rb#%*(~PPHv3}-zdMm>wry{>X+K;F_|V`Pw3WMB~LO2+&Yq^ zMWKa7fvd%}=PL`-jQCI0l=lmRk0fVL3%DXx_qyt!G=O*V=Z@(@~ zqDS3#nO9$XdEDtIeYs!pgj&lLJ}jgK#0x5NFNZ( z@E;fCQ(^44K#T}C))l`yLG&13t;n6?E{$0d)s=N%w2KMym5XaI49hLy3hMs&!f$CO zK7dh>P_V&bG>f}n0(cucywq%NPHNvKuf55;%$*uSicI>jyDKxF{UQ(u7o7SRX-qzY z%PSG_sNDKva`pbPpSq!oj?NFKhB5Ms0lTTA{uEo16>VIF-k@3u*IWy8HT4Lm)3`?x zgCu;uh7FFa#mfl?&jS`CzulzXTLb9oeFo+GS4}0#3vuu1$$=0#uMr(PGJl6$Ly`T| za#Fv3irVyTY55rs-LrFW`5WC_drj`08~*5(4Es^BtuA>25s#SQ=`~f?BJ-bEOiH_d zVnMH+*hCM5`JnPgq+1H zUXwXbJP4fXQv#-BkUzza4QKrBvetRBlX&*}9n^9dob+8ST+k;{yDhb&sg*l^&&AER z4X=U*CByaFU)pyN85?cpYwNC1wZXQ*n?zpy+XN0WuphN`(hNw(dN>RS;6N&Qsb2| z&g_L(j<#vWqc0kG7~D@;8z_aez6z}@S_+;e0Vme2^C*0nDO^_e$sKweEGa8X%R!s* zTiw>uDj1Qh{^R&Qe&W0lO$EG&3o{z1{2ApJy9qst>8yqI!5P3-E8H(#(+aN^G5eV9U?-F|p8*TI+RK2C1@7azWt zP>ZXz&UKjXg8aE*rJ?MxLPUhU*3$t1S~@8|MvwHZo3Gse{T>+mgh^JN960y9d$EZS zphNv>=x+<;2Fm%qvI7FtCcjy8Sh_qz+F(iA%y+U?FOYy(j1=)>K! zS0*6)psy8wJKPgL8SJkLeRZZ_j^cXt6@32Zd*p}^0TUOyDkG9sTG^Iq7At!wFg)#^ zae6J8M@5BqK4PPBMaIJ*K@#6XSi;dHoyR(-yjDztV1hV>wWU@zirR;K^EMdNtz&F3 zT8NN-y}xbdy{()vi|-~Gnq4SF&P0_cQkGvRGq9+5a}UA~VH)01IVrjQY{vaVZ*FFy zI}9Qf++%{m=;yG#UaZ*`MEiyTAmdXxR-c%b-LI!u?^vB=`Q022C)SOMyuvV|sg&GLTh>WpUcc z@9U-)9leI2=jc<}e$n;jBqc6Ygj^y8Nrn#FOuOj~0w8^$vSLoSh@@wW zt6V`1O4rj)Ulj7r@mS50d}3z_gtXKLa6`&E zWOwg1q0rw!l1$C|df=FhZZGJ+ett8^vT%OH+8LwouR=ECLPXc9k8rl>dvg+l7mZl5Ftxoh`r25MQJ)icO| zNypOyK771L2Kh8?*z0BnVz?)CzJG&=w;xQj@HU}$QySO7Yj-TF`f5q{FV)wJ9zjpn z%2k6XsS0k_LXwLJGTt{|!Ch8Q(##n$DSDp(f(-Gb8uh+NEBPXjbG1p4-}G368nWj*HVP?MSe zBJyD&_y{Er2f!LR?X13v=iA5f((iVNV@+3NUnj#)87rWGe0t}f3MX$AW|q40@S_AU zG(3ohK0OMY-9Zgoh0xvAJyKb0sKV%_m11Le+3YiD2;MQ@Fk`7()M23371{OVztLz> zvVQaBSMf#~6Y6&^$jam2hoVF#0h$(1d)#-?j!p^YaCqk zg?A_~xLNoHiT$?s7QR89&{Y55wR!+BC9H{%WN)_y!AWiRMU2 z>zuY1#QVmOLZCC#gcwFW1qRcy=gSETb}mh9NCN!dy^E_;&}#)SgXHvgr7h&Bp3Xm; zD(noJQXJEp8%Uk8@^FXn3^phAFRsi^kWvrIBv$pWqW2s*drP}LNL!2@Ia2`aK?h3C z#vW~bqY1-aD9|UIcWF{B+XCTD@9HgjFfkg@vTID628!x=VehO(Q3}`HzDLgb*5=a9 zvE7*9L35e?+%2J9i77)w7E|v9&>Zxsa7D0!RreE4%xUUU#lqFN)NPdD7VgT`(T-YW zSX#S<#w^f&e^uEyuU(VJD-2+YF7SKUTkjeGjygo~1dTSM#XKU5lb`jQ@$I}dA4;Uo zTsyAM8lj_L$l^r!^nSCsGXhNX4BL@oiu7sfjgGlaiy^t}PKU1Rffz(Z6(Tj>ULz$YSmu4oW2723gNxkkde-{Je(mMB8#v3(yFVgrksO1P!2n2oCDdQHv6b0Q+REsu(H7&dS8g2tRmtlb^=N*fx9ihY+ z4=Or^%(UPclqkh(+XXIuJ$=>HI7<07LnG5k>)feu)%(iX<5OjyEo@l+?ZE(-pxwdQ zDfr*1V6iwTsZmc(6GBg0-rV^bYs@j&sK#Sbt!N@&xg`L8E zXWRi&>DS;f>UR8Gt`Ongm~`I0<%2rC`llIj`5v;?tULCe`^XL_t_x&2hKKkusfxC% zuD_vOBg1R_xpz-E8YM7?H>o?NjRhoT;P12-h?|dQ8kuK(e=oOJcs>ESy?y?qoKsUt zmkV&8mCUYN`a}&x_1?4l+RkKud5OCuLQF~S-fGZc>RXK|(2ZV+?AJNIGtXtY=L46} zquKQNW#@<3BIj7YNR&UcFZLBE*5Vo5!}#|P_pLuDX8aYeSGv}6Lm05M_ozRnw)0LJ zqi7b_s!CUuH@2kNwdC=Dda`^K+CO`HIRa}7t~8A@Q!9sVhNxMHtU;m&>S3am9H{PX z1w_K=BDe%g{ADN)RK!v&X-n#D_Z>^`^5o{$5=r|daK#+;62k`PK8 z;`3CvCC;um+B@vwu>f_9i8crPRp#S*XQq%fgLRR_cznAEu%WGt-1d5PN`*mqHSlpS zu^@7{(%Z|O2>TiC9D8=HLpUq89WT9U1dG$P2;?eDK2cU(N8$%a868i~bPQlp7&z)x zPQ{Q782V|w2BnnNm(=thn_q#Jl>PUma}#jJc89T4U9R?OZPBz!oOBtmDr&|4vQyK^>BZIE%uQYjQMfqy; zV=4F*gT!xbu#11nFPS{!7vFSp3s~lveCwU=L#HFk1i5@6VZ)~{FC|Bs?*J^_-18Zd z{b+sX@k93Fj)3GzK9d6?sGI}&Ggb!iNtwuBjT*8o{iqF+vQjH4zBzmC6zLxA^e7Ea zuP8@i;lGL1m_~7;8$G=)b)zQ=qqiWaxd+aKE$yq9JI?v>m}!~a7r#N} zXb{cQwT4FjKVQPfj9QHq3V`H@q^Iqe%96B)k&on3<3^rPn}g;AZE$;lBjlUkJ-J2i zE%zH6-=mZhX-?>@lvZT4`(xv=)p4z=cyX`o+}QX_; z{5s5->^HR{CIlc>UBN{6lICrcC5 zL6GzZ{`gW4yj;8a6wI&I!;SdyOv*|(Rm8>5+Ti!%vw7k~>-pq~pzGHma@>%R-GEE-z?7(EPk?73e9Rab%)%0tmlg;r-Q#r?b= zBDf-5dwzX&#IByEBpqWQ3a1-N*1|Zl5z?G6^@t^Y+35W-3V<7YY7^9T6F*tl`jkx> z7SC1K+G|iHi6ec?bM3?rN&8ixJU|Yw-uPuoWoF+0-FWt23J!J-9IRJqQGx|yLZM1W z+FtLZiwG%udoQgu72N$xHR6Pnn9aa94d{DPrUczuOCL+0#ggAU3wvpfwcG}m9_ znB^k)gl$1wGwEI zbF#kOBGs*6q8~WL=tl^xu(5W~yGMsdgY^bKC_B=t7OL$f_%raW2TaJU9 z_CU=G za}iQkZNgC#i4|;TrdB_z?t#MJhZ}cjS8{-}y>mXI$(}ZtN1N#5tsN8On#UwwP*7X9}v&YT*;`OMmpM_2(O9`{rcD`DK z)T6On(QhrizE(GjG8sLc6PuXsXf1J{Z3wpdpxLZd@8lU&Kj4|S2DTYF;5*TV>4Yks zEmzMax882ds7lRg3A8T`c9{Fq2UHQv;&(fC05DEp%>Vo_6M@t=r{({os|0O?6XwC9*>3l6uF+h%6@h5>IS@+=e8BidYnZ^nJM8Kft3gIcTY>@f$pWh$9R zc(o8syVVIAU7ume=30lxBvSkAHNclSRNBCX_{!0{N&eVsrOkRTpxDcNEE$G{`SRYW zs%aeOv9^4P{;&phqF$SC^1j+QoUS(quI6Hx^7Q`KwEw);K{aT zBwgC^Q(e&J9x2vBegU%V5=wLvQ15=#pgVB_zxii~t~Yj_p>PwV;JeO5QY5G!%YJre z?m$G!Q4&hmLtQey)+2FUXxjaT|MCQ~#usW_wEVQQS}-5Ycm4HBrRP3!c&PyZ>KkpJ z(<_J-qBfUYX%>(|C^oa(LK~08cX|(8=(1x}q6}#HJ)gUdcoQqymgpOZlU6%^ z-nANoPXqVOAy4eH0e0hwCoTDq$}v93Dg0y12tHw(@ka`egA?RD9JQ5IA)_<9sCFSO zqHFt2bc9DI!vm|QU%e*a`WrwzWKwYOJ%8aBTL~nxSRc$z{Fl>d*lADb$1 zZH={nH+fyh$fy7KL#-euH04B_t^HGI=WVdN}_Y z>ZmBijAj-}@AEI0LE@|irgfJL555je)?C$MyKVVCNb7s+6wI%>SsekNs4!zg_ZtkM z>JkBp>23bdfbvKtmZ1T)`I!2+oo4oFXA_`wLeat{WlvLdw{MqGks9Ww+Hsral~8v! zlZb&i1w^uVwB3t_{=_Aj?~S{X@E3K?DeXA7)rX?F3mhPNQ(fUC3f+L&I*|-YlI`eJ zyFp?Z+?uKZ0S@UN9l#`ibX8E#cD0a3Xvg0s?@L(REWAM1fUDx?uOhzttGm8K3N8Z5 zk)g57JweThJye{UjlbE7f(_Z?i9dB-ms}o+$x>*jtH$Y=@oN@m@+xgeU-ar&oA@4W z#By2Sg^!x@p3mj5kFE7wn-+X(Sx4fhu&^sROZ;F?A9Yi3hXRDxyT>At*Otmz-GG$w zCl+!Rx60pva*-pMKB$zwnL0VNppwrQTW5N%G+J)a3V{oFR&fBkp6 zpVXJc(SVmL8}*O#`IC?Fm}A$ZC>O!~a%YX}qli=<6S)w)x0kQworj*L7f-w{?M|%L z^8Dvx_9sTzZe;SS_;4Cm*nGzDn6tV|9lFE{+6`qlb%kvNcuLhg@3usUNW8nUfFl;o zSUy9&nL_v0nx(59uiNh(zgvrwk|*qKO6M+z=YS7|5~?a@7n9pl0{m_e9XaKJO7_ zeFHk*9j2C7=X?I@*+|1?VRTq@(=Q$#CtX>#GQboYk~InUqy$rH)fKB)k5EO3e%Ss+ z8B5wNbsV;2($IAAV0@l`N3QKyr68R@1^ph}kBgUwr9l~nty1C}deRxhk;B0WxH~WD z39Ob#K7|}b(5$_+92;ukQP(1>T)8|XVF1K_Yd6`Qh~{{0Y4#~GB3@5lawH|zJC=0k zYOn=)J!0Wjj6`)0*E)SsTteGCiH~K*z7}Ao3E?OR&RwZ*-3;MV(0g!0Bj-iFpt z=dE-zBZw4pEh<5fSJPiwcNQ?9ueAQumN&f z3T=JiWBv^3eTw-YudiA>Zedh|e%yomoycFzC&FB5&Z<)OFS{DIoC)-nG<;g-{+6ps zQ??QNTb^?&G!9W>UKLTctyGX4*w%VB&~M3_y#`Nuoq8#lAot3<`kH4s&qt=Fp5s&Y zsAn>QjLU>3T;IhSlo6xG#W9k#zymC3;bR5ZgItX(q?xKuui^y(wz(B`gB6be1m=*m zkKyXkt#{98ci zX6d}ZX-1p{kk^_^@C-|4&TB|DYM^7GqpaL5u(l@;T3z&9rr_K(MVin)nE`CYjn&0d zVM(87e*a=je4o;DFQPKATI;@3y&*xpsk`^Jbf`_cudo<_W{iWMfkcnvf)Nj-QcqAW z9*JXzJ#|Wn*nnIivwNMIpdouv6Q^3!ukSDJt`TMW)--q?4i`zR1VfKrQ4_3kY}1P8 zVph|A*yC$?7x+00E2gmUkO@E&m1Vn=<&V2e)b$^L=QuW!C?K^-t1TfQ|$X!i`P zik00%&T9R1j98nSZgH@5t9xJGO(<#^KFeE88$K-j8)YXCvcPp!$rq#cT+RcQQ zsn6K-d2H{d6aa zDRP-auo#wpD~s7@xv5eUhOG_yB1WS37AsojhSx4|zw3y^`*Ut>GNaCYea+>>ec8%% zm4msvkz#mY+!TWl&X5ox?0Lhkj^&m7Sa2)7sGir zhR+@F=-FjW#^LXEAj#mhtHUz#rjPI3?yms*8>D!RR5Y{L+%W~Q;3*&KF1j^u4%QN= zJM)7C1(v^i+PQ>v+q;!~6jFUJ%FPv@k6ev>Bb=J=~=?!Q)VeRBE^W zT)4ZD3gz?sHB3Wkh>}Y~`)bLuZ zw=sufoqgB|(Ukl~ahi$61CvA*w?I@M0>V~IKc$1H3X7-y3x_$P^DPibEjit$WSV2sFM_NTqeoAM-Lwyr*9|=XqjkeMAQn3k-_1^n`GoJHlGBk zKt-IFR%S{jGz?hD)NNAfaU)y+x7gt^J+==-(^xiXHQ?x(Fe2X+{61w8g)je18+#SU zq_1I-n~|G_Ih{fwyc=Ay6c)ZXRc{~Y_+}L!kH_!ns1H~0%#?vGq_4FSN|Sv2hN=J8OLeolp-sbQ&vmDa*$(%{;zrNE zrzDyXEciY(ot%9qdh=^H>@4q@!w;J=OnQn~Gorn&f&)1m_eptSyOcGL1V>@I1e%&W zy15*aPYco`^YxI@M8hrM>rr5kJDRiN^1LEgCMlI|3uzEz$I|InD5T-tLkiJdnhnbA z*0%DdibUnaysw{SePR}4mYcYU#j%EMc**;{$YvCJ5(x!QY&=-n+7;2EAw@fxoRPV? z(fW&xgXyD|?@V>++-iG!@|a{K^N;YT?M5YE(k#t--m#_dS7y%_d&9tZ>x2 zdX#yZwcg*PW2LVx?8+(}Brbd5U0&`q<9fDfMh6+Ne0>DCx|94r_n_C4lp0$0w4Cf? zrOX3IY*<0Vds_fmG41c-?GpR=hTs&lT&%?jR-h<8+&*;BZ%r0_7O;LC(B( zph$t6-UB$jYnfAJJ;qj@+h~AtLx7gDebg{?)W+RcXcd%kJ+GlLb3)?npi|b7?A6bF z8LG)Uvdp!gKqH{Ikc0{aEsIYWjo82g;JhioK ziEwK~m6sv1iDpq|p#jXFBXRk3SoiW3v{XitTt!jw?u?szOQOPTPw+slJa;1kkb69} z)YE&;U#3Z~)kVI_8?G<>Fc#NTouVUuGJ!plKp#QQ(Fvu?KR1o%5SMQ zb=>K7JCL=`r3QOQ>4%rc^c}_~V5X;fRXv6mV70P(at4-@IdIz6CqnyCBnmHUv{6Myv|yt@;2uxovrXu5HhUAvWQRfH^3#V3G`M(Ooi z*qebWJ*ZG|`llQc?p_O|K8jd-x0-;Hc!sMUJi$EfY&s^G3V!zWDd6K@vYmA+F}bQR zO0{TQP*6OQcBD`;%w*cawA6AicpRjD>WTNw{-D!BC@*0inY3unUAkiJqB^z|cWH%P z$_P|{->xT6pe}@dicPurI1R+7_&>`Ewt6PZ2bJHrQ?rXOKvQ|4{yoQwea}7Xm7uUc z_NT>V13hN+>bdq@)GU3Tf=*;+Y6@zKt2Yc+Pjd#dBvi0Oj{bNJ@GAR^O;LBIL7CE_y^NI}C}o+GNY`wKT)wrx7qu%3tI>HxOb z6v&5@s-*-RF2dsYLO?%gUPJKYNEA+-mL;k+GgFkII2{14rzBN!I#mI~vwNrZ&SwWj zzNzs057mfK@rjH6{Ocg99`yEl##!bW{g*-WV|gX5?U|0>&a!WG(<9Vk<>_&b#s%Z< z%Uyh>+Xr9`Zxam%$&|~v1;H)kw|L^n`1v%cfN^W;7{?zw{{IHoK0*JZ%#9)XiT4c* zyo7sCcCN?z>3xCU{W!@NEu09q4f_spxNko$FQ930s;5)v>LHhf|DP?XV>8|MOLs65tG^w@hR_bA2k-00F}@L{Fk z5EkHa8*yufRQ#*t1rw^%+D_&`5@~Ll?+(5Ar#ueVbf^z{g_c0db7?yM?>C%Q(oe*( z^Y(#8G=A~_f5Lq&z&B#+?#14B34!R>{!=gEtXWL6EB{0}a6gM?ck?{FgQIq|5%gkY zCHa5mxg`Ve2eSpMZoKre&=7Itv?^HA&aXnc+Y;g{i2fa8-4{nRg=54)SuKLpn>Svm zx31sAPB?1UvB?!}O~26|4@feRVidygYGw*un0m0DoC@#a{3i~;4PUQb%pxC6qG<5RS=?gEj97g!mbgz3O z5*Q}CEdMJ+z_!Ov&#)(VPu&ebeG2A<``U1g-cmxyYuhCJ!vw<8Iuuj*)WCIA@m;(DrM)2J-3koEe zlVEwzUp<_7)29jvC;qd;NzGf5{ptQAr6b*hpMo%Dqt*g6n5r%Q^Pj;#YK>DkZVmpA zx0EzAA3l8ehtpbL?T*SxhY2`+6-k9R2L1umM7T6RM9nwQrOg)OxXz$AJpb@zj>9CV zK+{=mv@j`K%xl*ryTq5lT{G5?YXN%AUKd#ZwkXNT$*HS@>t=;vw|ANZijQB{1Lw9% z1Re_KUUJ1?5UZ=rT!=OZazCT1Nt2&UJ~!^&W@)Y_<#HF_2L0WtER6gO&R5+}Vp&n9nJdWbPtMM z@SpS9z*qH}zPnqojhs9@rRwyshLf`M^0vFtMV`7zGmFcGLM%p6JZ;H0hv zHl!&Rx#ooR^f72~0T&ZWoRr`Z^X?2s7-VkJ;Pc2ulJHI-x0a~#RQURa!_w6vc}dvr z6crgcZOmui?P2ZZR#!`_amL0Tw%FQod_;lW@PaR&F!J*A^9u@U7LM=knzEozfCY;s zF6&ii3TZeo=rg&>m@u9M-r%MyIk{TVwH1pAIqY7%!vbnrG7hslV_q_KpZ|o{PPLIV z&P)eENe!YTA`@wGQtgwFGF(i9l!xczW&NbF?ZUKc#JR_4I;ILr@cz^7TV?y45FoE|A#P}cQ12?D(tzSh{Dv5 znj%I8G)cZ`qE#)74+_1`Lrd&D%`M^E?El+ti$98DooZS zoc=wcuoFg%(~kd%%>m$CXJ~`nbR;D$e0+Rt=$~wmV5zj%KK^=o$Q8xK&TH*L`4+;^oG;# zNCZ?&xb?VEbumu=TEg@XxVX^gvr3_xX|9Kn7Tz?m`UrD!&W z!})u-WFaqP*G|1BvHz_^eQKbN|0XE_Y)7Ds(Qa(0b1&^(!Au0q1eXq%EeCrf27?Ce ztm~w+f3xb`sgYjdFD{~#mkY<@y@LC$)9SVH27NgzHMM8wQhA>(O~Kwi!?FE-_T?Et z*@_~55CnQ%uIcFzH;yNV&alabdnp}mrWG^;u}wgD1vggvksv41trr%o%#;T-)ujtK zIJxSXOFsaL#_T!BNXf6i06WHS;dsYu%;i?Swz6o0H<;YNbS{7Y&O_pN4ifUc&BnM* zTYIAC;MiLAC2i0Ry(k2kT`P0e3#yQeZlPx#{5h_euVRHY0b@3j)`#|Iw~_A{91PFu zw0#)p?R1$eYK=Wwy1!1(&H-0DE8ocDw zQCbDð>P=kJ|X3tCX{dN8yP3dDtb`wDe}s)_x3tpr1by`YEw+~2UiSPs{Zq2~ZT zCgy&NRQ$``%+OTfkrMDw%SrJ1(_1R4K^RqX9r4m@)T)hc|LY6)S2-yS)+lzK;~|Om^sC)CO?cjz6`sI=J}mvMzf^X zeS&KT^qF}E)F0Q2fyxe{`QMuOp={!Na^{2H-f}}~xr_>q?RVahZ!VA>{p?KX=lm_s zhSNNXz4K$2YlTw+muGh)+SbzdHLRr)hiHwON@yd(t4{45J6!&L!{GB@X@iW!=8?;5 zTx<+4&3qJ{JUa8Xv(B?I`%&97Clauyioeq(fr^TQ1mAt$27HM+Kd0ichj}bQ@uR1w zCygHr3VEwi4n1@YtiFD%H&#OnAfCeDD>a-y{}Wm+ekB%P;pcH>r1b#s>C`_LHVU-? z7_Xe%1Apve{Sy^Pki1ct+y@n@KN)3trsBO#))@LiDgSG*CTSUDkT`~KPs$Q5_k5pg zo)s$`w2a>bus4mXw?1#&D$`CG-g_3DE{4i>=Sy zjWHj?@+Z}LJnT(lF9$3VI{o*AuEx>MZt94N=f(^u#Y##j#DjP-jSQ2izHXuyfdyQsT27gaT3}fgzoq6Cy58$*y=+d=GWxFh+8{e8 zYM*7E4jo8{v@`ET&SK+=%jvsJ`H`ivC1O{WWnLk@{?zkD%#BP7rbO(~Jc#4+H_2*a ztya_-b%Rz-5PAQ_;@J(hJ`6 zE%a2O5StLRR(&u}{QjWh;ot`idoYkC5xJ`sTmT3PXV$#Qv449MRlss9hM?yXgL zPq@bH5{Il=u7I@iH1AbjZvW;@>K{`<_FVR45%6An%}nW_SwvfFRun z|EOl--`gF$lTjvcWRs1c|4!<6h@#)okWO`hl}UnA4NNoPJ~VOQdFnzO0Okh$&)Qxp zotadhea}31%5*^82M-XaU^!8X-Nv}E55$m<{ml2NKQ_QTr3C)X`r{ka33!87ojM=G zgQ=VIb-vc6*v|hbh^6@D@@)J|r@V0;q_e$QXy|>iD{c}ob)4sFeqhc6Wmyedxw_js z1WD{4*g7bB9^P0`;uKUq8Q-fNf?EuWJu~(4mnQR%RjFXW_s!-3U)ylLrkCqfc{oo~1*q$F5pD9i1ozW-5ID!dQA7Z8vQl;)* zithD%awISSmPpZKGiN7i&ze}$tTfW6h8Ga*JJ*RY{TyLN3#h_C9rH7$q?D8RzRz0e zXrJAhT|m8WhZ6WF(pa(9TbChWt>J#&o+38GfE4;1#Gj*O{4&ZAekWsee{3MKl7q$k z@Z3^a20|QmFidZP22D_nY5>0b6OfiE;H9(0lX5cO`ao2-?Ql6_WyMJFSq%>2 z1ngDF6=%yt>WZ?~iI>mVH0b1%hCh>HPK4NvS0`5AmV9P@e_z`r&VE4f4yM(Ht3aj} zxtFC|H)2woad6OWL>_X5euAp@Uyr$hj?M$%C$0(38x2)jU`h;Bqv5x0ijpZ0#jKV6=ICB!3NhTvExX7{h76j7`n#vt67vc~H|;BR;nAP|Kj= zf4_u~`64P2yM4EB-l*@C)~U;ioKE)r43$$H4<|y)_CXqFtsat1DindcEDGM;o!S7J zQBf7X?3slJH}0WBdXe==xm z%G+Xw|Btq}42rY))_x~>5=ept2?S5j;O-U(uEB!`cXz!L2=0)tJx6FW{lH@M}Xe$K{ ze6>p6+J0T?7`I4_s4bgfMQgN0n&^){u zRJw%pZLXaRYu$#e*e)A5ABT?sM{SSuNA_NGK#u`9EW| zMy}C{@i1avLz6fgOuC$@__*NA;HrILYJ$az&6In+;7PANMa87#&e!IW;^=858He*y zy=fAoPdEGJOREkEV!wpI1FcK<66 zSFNx@e-JJM}&*jZuofr!FJ~qzs zTDl8fY`X4>yS1NgVAa)2&)%;uv#(v#^jRwJrteUEMne%p`*)og^-!ovLuNg2C%gK^ zJ4-zGHz<&VZTd(yw);F~IFx*>nEr_Z=<$~xjb60W9uWl8=hUboULD@8mR1EBo9& zeV`Zc1Rk?Z)|D%)T_Of?QU3{;_59|g(O(xTf?06m6ZIJpaO0ECnea6adnQBvX?^1h z&k}6^L{dVW)BVcg{I<+@CCR(_c$et@s3q^yYisiByY5=HxLJ|=s|!jc|B<&%`aBEHmboNW zNy&<0e6bXP6pur;EtD&6w0W=Mpa@B0Wc4Mj?v z564ADH&s=ci_O>OA_{t*df}a#OSw%+uFj^X;z$o%QAW4Igzsc*MfmaP zfywKBOFTKoP9x*`nn&sW!N~rlx0`)JshFU3Yi9Bty3XV@bm!dP0VFj4ee@6|G!0+02b-!LwY&6rRtb6(31& z@N}9@#0Tn7|A>^2ZZbp4A$)q;+F{J#qb5|kT?u7I?dR!f!*#x=&6(A{+_Z3Kw#MD! z^5_s8WT^iak#L6-{B*xJngh5Z<)yds3JU6t4 zeM}B-uPeetCz!Rp=KCnH&e4L-PyM#cS{o;TAy`^k$>=C^@pKr{1AqM!8Ftcadg=I@ zyovth6rWv{%}09YZtM5>uDUSdh77t_a14)fVThj)G9^%>32 z$FKLEZ%0Q~dBj16Rv&7bxVmt{KcSIR1_@%2Lj)A z9RYsJ{%ZEv6f&8|KB>ONBxDpwa{^C&3NCy5QGIF{&&)<8O9tXGv?bl?8x3;j6^G{NR8BEz(9NZ4blYf3d#$wiBJAIu!yv;9Sj zWLtr7Sajp~@}U43YCCx&YatCNkpY69r@vt~Vjo|#yw?|OiSbZY?r*S*4Uy04UFl^3 z4)Fa-tnQ*H$y>|A3npX?4fQk2yAGUgk?x|De?zV;4{S(5`Ns%KexM0zVt0qA766*k zn5nZJ3zT@d_5;uwvBEs%EuiZXhxyy)Zg^bs3xe@?E!m>WHWdHKC zM$BB5+R>&2$~^-$cp*>mm11nXXwD0HRt@R z<~g8-rdUecDtMUgK|yM>EytNJEnBze?%&P?_@Oh#D{h;qOQ3m4AE|Y01ggvrSd-fn z@3A(GU(rTTgDYCyW`DusdcnOh>2B9qt{}fxg*GxT-o+N;kX6r`rPi(vm~&X!BGr^p z+(}=5Lv&>uBW=9I(6rmfQRqMT6iAgEXH(|%RgwE#VO{#c+drpNuboZ&9pbE|XPuk+ zeqZ*zN8J{At_R%cZjkOQLmWy)(CT?lJ zil9m2jy6c)YJOra)`xRS_;cunloKa+{Md>$A1&LW87*6qOLSS5#C~YRNC>vXxJmasbYLfw7qO&Mp0MyaQ=1@ zCX=V8b=KAKxD&M^e*Nl3cb5xTCLm13lj7!_vP3XinyK)b#w3A1hKz;fTk!AQE+KL^ zuNS|$1M1~3qg(r@9P)FvOqySIIUD%|DKE_|ubE2rnsoQb+1ftf@_&LX{`wTxG=zwg z?UTna4$tP}9>KP&SIs6!QnGaW=&L-`uOIRfZGfFG<;+d(^XMQG+`^FjFTDq%ADb= z6v!37OX)+);y2iz$@hfhyE8QxNIZMTH0|%+?6{;@$W~9!&~bZ<2{y7I^XK`twr9md zh8!-|2lB#+l4hZ>q&lTM=Y|p#^@54rF~7A)I%4RRYbpt5YFq1=SXjvBH7eX|5uU*T z-~+@`=O4~fZ7}P*JS3Nna!-?S*Hze+C=7|F&3mP6sE9;jj}B+QvA%!*yaVeQn9|fc zGC(63>eDOw4oy<$O}X<|0SoFBRCgnuhgMn*2EDwS-L2PLod9Fi0i@aO|YXf z0jh_dhV59)LbxDz@krNqD6QVSIWb}va6+qMSIJxEAmt~nkq7Apin$LHD!l)KK|ue; zXsk`xChzO_itZN;9zD357Wg>p-{N8kzJ;OE;QO`UTNr3Dt0%JVHwF$pY3elE(sqjq&&ce}(+K z$K!uwcXN|&=Q;i{EE7VYd@e-00F-h^ki}>4XGO>LMn!Bo^}L+O!JQ zD{k<2WG>IE>^v9Jm3#wAay8`iqe>jj9cFqPshBONMZYoUcqbn4C7Z(%Z!=}u z`d3THdjvl32vuM#UCt7T2fqk)&@OAU=LAkhBi1?xs7x%2IIXdC?<1!a4M2u?&+7Fy zba3^n5PqtHHFaJ{L#swk_-ORngiJSG=>n%kj%-ittsQCaTQt~m7W0rN20mG(*04tL z!WYA{>^T#}aDyi4E&SoOQ*~gQtsd+p<^9gMxWnc_Idpz^0H6jzf7|8 z39xn|C_*7%)3W!xWqM1S(jjlow468lV_RDIREI(T3gUHo6-Yrm=JWIT2_*$&^@3MG zOffSrWndqE8C@t=<_Kwyq**z0Cgrb=OA67}XK(-RRNjP_ft^|Q&}7$X44OZQBt*3_ zoX;(u?#GQWP*GRqwv@z(c#Gis(t({%q}NWUt=|}TP1xLwuCO>j#P)*6AdA=8h~K== z!h;qQmFcJdJ5<*QsDm_Cx{d>c2-Lt6C5MTsou5MLLS6dn)>^zG@rxeUb030YW=&PN zJWI-U?=erVLc75xc&7bSBq*?rx|EvIQUwKm0i!+^hB549B6m_{q7%IjC))||)8A5U z>H?vGJF&^0urO)Nctj;JXYGZnt(i|E_80Ajx)1YE@AGi&^nj#jieaDuev6loUuL8f z4Tb|?H@6`>+pV8Pig%_OZ>j0M*TP=Rz`&Op2TvLs;wz{)`j&Z>MaEJ@BdSMu%Pk3J z$wlpltV+Q4Nu7;^aQT|F>x%s0;x!iQD>gMd8)Y|bl4yypb_@KRqJr8c@9{MZAGmVg z#Ft>#?t-5mN7{vZGyum!EhQiIxXhZbMOJMPUIP=R$96QVJlq+1eYQIi8pQv>q%RY3?l<-zPzQ z)mE@O*K*GX|r+KR(xg47157t2NWioCtd_*v8AIJxq*XTVwIUPNvlqFM5vp!+9q=ZqlFE`)VSL zk_byLA&$r14;#2St~3L3*Bk`|1(Sc2QD*bLp=FM=L3!9#+)gm0*&NC2wP;&|Nl>RtH$w2&`X-s9>%&y9-{pRQ~b z=a5>bO#~9Eb=p-<@wY=frCaROF{@lMIpy#KQBnXsBBx?SGC^4l#(2vUD4l?Sv4nE& z^yXHjmV8xdePzDv7bH#XrqS~zOdOLPqtNAC+Dz&Dma+16W%3!j2}RH>=eV|34wa(k z2}edmOVx{yBepv#d;|UXNnF?S(ulbTMD~l1!~jgKlnYE6upzv2-d|$U2D$kb$Ue^e z?SiNnFn>6RT$nNykHaG*7XhW|1a*V+x<9IK4VZCZ8}l_27x$OkG}5h?S^3D6_Zd#{ z!a{YMw6}9lb1BM|jW;+Z&c8OuBzxYllR>Tjj$KDzzF&HzQWc&?`u||)MSZz~M1{W~ zz{{om)eA|ZkjX(O923Sk^%XsJXhddvTtoMrDUT=22A`;8p_FQDKw1$GZB9SDsQJdC z7;f~}MWsPHBQxOxZpFAXQCDxo7)zpKe^p>TLrm+{PMtPsGRqaM^f4)-w5aT;n}hVc zKVld?P`rbNG8*DM=BQv4E7mO*UJm{UL}wMPOIN$rymcAypEUVW`&1!ol#dVY#?DkJ zZ(lCac!O5XW1@m0EU4z^qbw<#_EzaNrM3OErtD=Bmcw>gSIXv%r(iXB*o<8$C5-Zb z4CYBLaxWyS`pG2rdC|h3-9jsb@W%OVwU^k^2Rh~irE069eVx)cgs0O-XsLZE0D;WF zJ~FtU90y4&a*A_NV#IoXUE(dgY!|19($NNol8US?h7QX0hq=^b6k5{!W!c<;K#*j2 zIYn%Ysr?Z3IZm%~>AzV-k#_tdu?JJ=aa2$YCYp!*w3VtzgD6s3)6}L^q?kJpJ1kr) z6jQDjyUNy}C5S&T?vm>iQ``@X4u`?VkFnghD}@S5uboWnY_vReDX`M-5DI$2cBfT7 z`p{UbcS05rf6mortC4I(oTtlH#-1>T5$#r@Nh5K4nGmvuR3AQbIO!rFZ<#NP|9d-J zt*?z&XlKp5q(6U#%#PapU-zY(bq{WvxCbmbZg~HVDMb-dWh%Cr0Tf_+Dbqq`Pj|Ba zyG0d6MVG2+=P!7}lx8#WQ$)^yN0W;vWKmmZx-+w+l>79WF%d~OkF2k>_%>@irJ!Gp z=VzvDmtE@#&Z$J&Go=ziEcrxJ_P?W6$-UhKv7J=Ad_5p}5KLouACK6vEy48R zl>uxlmF>)`eymkm5bs&1prj8&mbbjP-2B#Pmv*M07ydz zH{yt*NcL(f<4(_OkQ1hNE`;JbzM{HtJ7c;c2oyYQspX}f{V zer355dQ)hjrqyiCA%ut0&qmqItZl+Wc}d8mN(ZW~ZhKi}YI%m2JOD4M%h-Ff)@Y~D z0xe)Pi26<2URYIa>cNp@C^TaOB<9iWq~zR1Lk^Z5m=`wKHPyLZGZ*Q^7xLI2WPMpu z^b*q_5DYX`YE@52py+5WDy}hO0gut}4bPvDulAd;%YD}L^9||mW2I_jpz*us#AGLo z{#1-Pom3dB1q<`E%-6dJAQPvqzK-kc4GWX36SUWt3AOywT9utak}9MG#E!c*Xo(=R zfXRQLafy@leU1<1W0B}3MYu)EQ&v(^!bUrpp^YpBGR2iRecoYF{RZCX+ND&Y^na4% zeO`}2Y@NDgzgh6-U+2r)z$#v&4X%HyTlNA!>luwd>6*SYd@`X)wJhgX$)XgyihEW;0ORI?jR0Z{LhuZkW)Wihxf+gpl_7A)SjMJYAnjn?#er|pxkeSqk zp&3n5!o-5gRFs1OpJ!kbbE(sq#Nmxf8A*afscOhEKmLm%k9Fk_?8$=(5_{2P3-(3> z+ot(+oV}{O&Z(I-)6}v5hy7EEKO!VmgST`Lm?#`>bYfGoq-kr6W&f!I{r)k0lE%8Y zRwF(jIgW2^W;u6qhgQU!0!q0J-Dx& z(Bn~b5{8QB#V%?TppJZscCM&hSjn-UPLZa2jw15~EFDwVq!XM;n%peVWaQ}|iZ(%A zDVA8&r16F1uYmR)&KWgDQz)aM4p?0w;M#pbV~LC@_AY$nbshH`5iR*WTbn(q6cqIU zm8x$PCYKi&(RRqxk+>zh<^|%pdH)^>AXE)cdbkE9%yyRhyoaSX-W*=t$Uz_Pud8Sy z|8fn+9*kOEKk?8EHn%wpc4;v1I zNT+#3(ZsG4A8qLPm6Eae|FXoTu&3IMr}vmbV_bc*Q->4YEs?weks`Si-oS=GqE;U- zclj8Tz-TYyP_#w;z``avm7KwtK_TZz^N#@jQHC9+i;{JdH6`^K1xzi{d7e^d^wRgw z+To>!OvWz-+v=$F&Xrwb>y?0Zcm4ZT>jUs`r$B~wsC%$P*9vB{`<#5q>U!UkmqL-< zy9va+`qF#}!s1!p(gu=`38Z@zuokfGXba(kRkn`k&~8t0`Zms%mbFKN;-jSKNqiz5qIg!K@vyk(1*B}jZd(A}RJf7h;# zO4Ed~B%4mf#NhPD&E+F|`kv!LFSovaJv5M98mWQ$n6!%j9Z4nZ1I+i2vD#!Uw4^@+&< zy77TwUdnZe(Ib`sDNB+1^l}kLb8M~XyLR6GdO!M3S+0SSx$m|)W?Fs&Z>luaoxgEC z4)A@S;8XT8c2%LJcQUjG7XOQhk2y4!%ZNOTO7Bpbu$y z^TbGI1(;9nX75V z8~P3|zry6{U$14d6~I?D4b-Z(hGeOXl?)DA&6Uvt|0nTC_4a;I7i6M{tnN&&9R4);ZCp2pY+MM{6v=pkW#b`<38 zyLd*!=5^NV;klZ#s}v(66bKIvMy6Hui@lNkIxQg+Zhd0A^#>*A-_;$-`b@ZEV>qhaqGa-`Ig!jvqn2C3Y;&x=EX@Rf ze%hx`aV7B0-o0o@qr8ASZlHP!N7`uC)(s&CRyLBwhs0rcWIVMnrp?-7y?8<86%$P! z`s)*dDp2fWC?4zmQ9vp5shy1rezBffeK)%%VMhUxlw38!#=z!ZcncGVM(pJtqit_j z_YHqZ6R_M2SIzeH{W+G4bo_0wJpgmJG|Ic2n_Ou^pK(KN-L?GFr0U&k_=Q^7suj85 zHbwS>zY=U0`%?eP;6W99#Z&sNNyZz_aC%D0$Wq%2M=yk5s(gyZiODI{8_G*IEnQ9Z;P=FAraA{x zSLu&+N1Tt5Q3^v$Lj&CJqibP(JPLxL!$RMtao?lk*5px8E;P)rOFIi`$vGL~5?^k9 zM}0MhT;84x4hvGm)QQBgT7X(gWTDc2KY!Zw09IsA(w-hoB@NyECh_3*8nT|_Tab*n zs9NjoFWLJ1h1{xapJZNLC{NaxpVuj|&kZ>4(J!2$d6|a~I#)dIJ&vd_f7$RmZeFDb zxcN-5@uP9PuC^pniWuAGz+E(C8Z1_I#}Zy=SAY*`M31x&0~2(#>lN6x_j?g`N>hL6rk%&%Bj?&Z*7% zVC!MqwG8|@+o9TQuZsu@7E8R`#cG?C*N^c!TR(V}-1WD84buqyLx94ih2)rpRJ55( zG6m&mafx6q+niua#0_Ao=7Rm{o>Ag?Y5C#4RnEYGECUmNc`yM>0F-mQY5SL#$D)h* zM(Cgc($`XYw0xWiRW1_KB6t%bV-9bR?{-t@Ktrr`P1mIs$lSY5a!W&+`Ry@Ip~_ zT=lv?r?~NVNkPw`s~_S27)X@6I*ij3(4NjmQj+`OC^4FCn191>@kWUp&AIsG^x`(2 zs315p-x9e@@d{hM5k_}zFtrIen}kW>4;&IFE;t)13V!QsKfKi%rT{rG2M$$~po;q8l$=+`KstKqzOGRiEJmR!Z82cr?Q z-j|E>I$QPEy5Ob;6-Q=u#l6Gm;-=g(dWf3Mtp1)#S#!~5^cg%Y{3vbC+}!xcN~8MJ zf|IEAD_+k}=`jCKIKMu;eeu(*8fM|bb7=YFw{&Q>G$x-v(0$Z*iaEDqcaC-&ymB`A zfOnR>l`;e8R!P$DH<#d;UqqNq3D66*2;9H?RJ3cucI`7|x_LZ+$;Rb%;UuXCPZ{&g zNw+y##e?S)Eb3*!#q@kXav^fNbV8=PWj>p)V{ND82v?GjW>zI`A7O3>^hI4T84xFH zE%U0dRh_j1skNN8Br+D2KW)a){628=Vc3mQs>gi~iWjtFP-P@na@_LZ*UDLt-cL>6 zA_x?%%2XTTC_rrOdRGrUE??cvV@*|{cMU2W&|(H#S>gtm&0cS%II+CZ{!C}E$mu&1 zDix>krmV*_oX#AibDh?sHkgp}tm%{LzP&AO=2O%JFjE+qa@nQanAR}4vWt@JN4~9c zlLDXlP`Y5Yk5$JrV^dWpX2!07=@y9PLC+BLP-VVU$5aqZOOV?|J0_7zl;)m9)F|q8 znZm}QdQvjCs8L@PKZt0xob;SWPcu9>@w^;NHT>zZTrvnHItt3zVj5P$Qki!(rhla-> zffQ1yp?R|VOsY^9-ub4$V8RKp(hR+C-@b7#U7TxHJ2{k^F2VC;^-}Z>VM}api+n

pKH)s> z^ERO7;m2m0tKx4S-aAFu04DbxgX5p1%qEVp3lagZ24$Q%BH(VqnRIe-Geuu&G|U`e z1}=94V}G|rhC9n?4mw+;no(x9J#0U%7(5IZ@I5`2D;;g+!Oa|(^v7qeP_=!Pawi7J zcDLwf5hLzaT_DAVAXX+;1x$l>5AU|N;;Yqaa=T*L@|1s{JM| z8z*er+?Ym=ycuXAv1N8_sG${R4H+OjLC^6k2U$YslN?R#^N~)c>-m|^2{4SW?8Zb* zUor1&bO1)B0o88mYRwALp7&wqa&@b{v*F4Uau+LIU%Va}(wLMoO`JV4it;M5RQco62L-^nUSaff zh}%!3FoW1L{LJ9-z*7wNk)plB%mm7V>!~C?R%8Sy|3z{oraPju$EDsF@0h$t4#{$ z>+^vtrSOO>2ux}t@oaDs0qks_PC&PX9iRqVKKicqRorJMOR1Ue7n#BYCuWQ?bD_D|By3IvoNZ^8SxVAT8P^*<08;H&OF3JqjzJ>s zL`!bR5q~4Eyt+2bid8dLF4KfBACF2F1K=*d4B7_*Vb?aZl^iS4cnOK>u3E)u?)C3? z!lnqTtI@{J^R;Ik&Dkz@%_|{)?+QliE$6H1k}ZjNUuY`}6p!rMO5|MRo3eE+`DuR!`Uz;IC@6$}l$=!{E9KO6~) zt}n$)PbjeSH6s=FI^Dd92XCh>wKE1 zF;oYQLw*u~rkdx75iiW-9)1sjwvIUS%nCvO&fr%`glnFi`!f_Jw=Bt?4ssZHKlBhx z1nE?Y!g|L+ z9bM3vd*(#03@WyZ>Sljaa$6|XG05O^4pI}UGd!MJIAkf;H<*izvTJVU_F&?R{;;dn z;0b&z``|n8tXZbZ=XHLdVCJFs9J^)tJ)hIw!zv=M7|Risn0Z8rVL<3tP3~MdD)-OC zD54#XEg7?^UEtE)Z!eKD@He2RJWlT5a2{zMs{PCD5-13R)Py}JL}b(Z2%nG{Q_Txb zt*H?Z-M~`od)w!$|G2p$3qc>xzxD6)y8*s^_k>^O;oTB-l+6PJ$;pl0yGn;~dR5KV z0ke9Ba5yc;3()0DA=k5&r=$+tI`*31-<3BR1zx8hgw!QaNbC4f~GexVN zajrIQ%{-ndo87}Bo5KbM##nSpY!8JFX6^JFW2%U}Zf~j0=5I_O59gJyLRYSft%p>c zj|P5r?M*iiArrhZrnU*nX%Y{#wW{7~JiCOX)Rkcx_?`F7PKJ$eNk^;+t`=SCCh`iM z?&b;3E<(NQH1B|gwHnpyc&mhRy+%&W3ZYK>wAYN$z@<4|&-Yv}QK?tYev}sFn<)s0 z2yivq;Cg$y(JK(GoL1%*QXP#B(*^p+r4ae$&hp5ToV?I^=soYRO@6sl7d{lG@(EQa zWkDipVwlnGjAmqb=NCqz?Hk#>sm*}EEoy2{+6+1@&R%KYr&*@k5qv7Gs)VMXw?O8L zPI`Q86JM;mq)u%j-pkl`-&d*_*YO2Mzoxnwb`n06lLVR_VHW((+qxMzN#45suIl-D ze(Qet+J~BI!gP^~Vw=&V2#ub8`PuiOqC)s^U4&SrU<+4e*voLv@vr?3oj;e$0v^2} zf>aNuj9+M{0S6PUiSRMTL;L_y(ey^PR{j=3)#{TfNyj|=VR{XHHlIkT(<|WV=%T!= znD@Yuu6m=gx2v!1Bz*fl)4O)x-NQ6R(06j}4AS=5MFP*KuE)V|qqCE`k$uqfndbJT zO8#)LX9uey9s^#4tPkDrN@$*vJL#QY^l?q~3s8p!pr%@#-z<50{A-*faJyqdzE(|DiL_N(l;zO=X|<6bJNL%no(OTHCtcfDstkArMxyIr z6?&GbK@h=;6WWIt^j$CXZBEZC(+Fnbk+T2QL zkyEFLDKUk+wL)Fyl(TwK=p z+hj~r=RW(W*x+T~agVrU4x+&P_2 z4Xdrf)b42Yi5CD6-Mj14#Ker&EF)2V%;Z8>Yb>+hZcsUr1&xu#wj~p*lrGb6MmC;L z)V8pDA82GuNsR&*6LW|X*Tdz=_odut(*L#TJb(6sCnh~zd4qA0}-WmkwNUbcJ1f{>A0R1@du>3He>^m#oH^nKv<@Qy{So52PDww#&FIxP+ zwF2&cE!#z1ZN!n2P}bwa6YeN(CEly=`fg-P|F(SPDx%?I7+$Z2lUKZIm zA(>GcnqGc>{#T%m<(<7fBI4%e8^KrNpo)SzoDerNrMT)!wr+9I+!xNj5s^LInE>j~ zSD?!&jpxXHRmKTFJaVu~9t66S)YDr^G>Ebj#(ItoLO@DiWT(U8HxWn@)Z0ihe$P`X zTn4L(|Qg%ewW7Yx~KGXuJm*x@?_rC^+m_v4RSzk z6Qj>3+z!;M;kabc+rc9DD`bL6D(bF2K0Zc96saRPpdU=fH$HlLdO&)5dK^`4ef`7Z z(bKE|LlFgXE~5@KKFl`>DUH%Edmk+b3AF}eUAefr-aYs|2UWaGmN&COFh5*vCAznH z_38ZE%b!aa;yNc>)c;{5RJ?nygZu9z4f}t1g#UeL__rDOA18$We#HN?{r|V-3KN!! zww(@ukj>MP3R0T9cjB6PWMYTa6Bl%L`_T45CR#tl^v$`D z0GA7&?e9e6?yoC1F;1qRGHP$WUUhuPY~W1Mt=ZKPlT%v3HoH|}%!66;{J^@vyiCO< zk2Vblt4rH%-}$I^QO1w@w6Ngq+Mn^fiO8Y@qB#aCcU_iq8PGC>mPvJ;#S`MX$dxw3 ztn+n(Qe?aBk>Ymrf(?tt%*UE5PU6$5`*H4l#7N58Za7BM(z3@@+j~lnuJ{912TRNoR=f{;^9r(}MXlI+S zA+i>;Q+^_~<(vKt-MZCHvo?*1sad_>a37z|$r>7u04e^QBNt@Skm_xCU01)4e(XTH%MyuG;E>0uqre|d_HvE-u4+cQ-Me+e<8^7)#DGI zEVF~t*wZtKu9}P`(RVlRJ7)LPxvlqL5EAG-9Jjt+4X&sQL6f3vTa68A;eD4mQU8u- zj=$W()UuJU*a*6ieNK-hQrrP*pJlp_RMy!T zGt1F>4avP$cqTdocX}5{1^E9ojXexgu=sG5bU@V2O8;rk!rCTbMzy5|e9gulJ&2`Z5T+rPN*cCmP+3RhFhF`QHk|1qzG6r!<;Qd_^1 z#s+w7fI@_mNV;EPOz&z_T&`&`2cdQrjbqI!QOtpEV>BwLMZ3I0E1uqJx6;Oe6%pMx zWy@%`4@)zvJc>Hd(sxcD!s#Y?>3PR2W6Uy7YaBlYe$ z)yoofIP}I8^<~P6H-QQLaU+Z3!UCEpf3r~wrr1B-bk?_#go6?IVb|TB>jX7wGcmKa z@bJ19pt?XqK6tX?Kh`VknV!WK@9`-ehOPXK_oF$ytUCZ5^H(DgII6>!uEpPpDf<9w z6+ei1kQB#!lw6Cz8{z%&+iP*7%JRG~qfw>aUo75uEj5Pn>Cr;crb%Cg?Ow;Ll-jbG zarBJ-P%;s#N>3S&V1;?0T8_&`Kju!h<0H4$VujJc2`ZT!nJHp}6(#?V!_c?e`s4>` zm@Q1}Mv6eWJz8*;aVSPSe!)|BiaM*c`_yp3hC%MeuQlJF{U@V`ey%&=E}l#*`KQ_8RZffSIXC_6jk%Ya4Q9OV4uZqpQSituUnKc6LnFYUEyp_lm%VWyZJ}Egi6+NBK1vch&B0gY2HkvO--|sig3`_IO-=i>^+& zD}V5UF9nO#@)Nw?@3_?7Z*KRUMaX&C{(Nj~AX@abHmZ^(bsACP>!X5pP;V{Q)y zNRsO_g9B*&ulyef4Gvg=9^CRUE_EXJiyvUdTxz!!Wx2rVGB5tAr0n-v>+@2BC#%`( z@PIKdxL~Ou?ib~i_;sXWjm3E)W_^@Q?z68W!n@!uy_xF&=qlAUrAk;$x5;EyCHD#I zxmtjxt~1;rd*J@NJA?hGI?bFmd#UR$G1NG#8#j6p49-S~ZsW`NnG^{xs;yB6Ne#;|Gg1p<#o`p}Ik&?wO>HAk+J;N#9kYQaLm+Oxc zUqw+W%p>|j#oJg;?N~VQl=9TNm~MgjFZx1k;PJ?*DHppBUQG*a?+jXXpyu6DlZq@g z1-s#~DI|?atOUE%?cfm0&HUfTv0wiPCk{hFaO>A6w_PQdV1`V6JfE4$3wcJUQ(4dU zO#JA|Rz|s8=$aCZ=B=88)26P$A9YzcxB$%(5-LZpqqZw~`U0fiC?q#(p$>R$v-lM| zZ?SMVU(D|;qM7AQmIQ1GA z53E@}HOJQdGq|~NaigFtv#2P2be_KZ>B*8Vlw}>}r1^SYw-Z%|Um!cXW4ymItY^d-3qVH}^93xN`g`%ZweK*?1j!x^7g z%Xbt;RF@^J16ur5O1p9L-TvxsrR2qDUpIDqz_M$VJ76qaz%Lor?E=uxL3JMkkPr?3 zj5H7JZA~?(sue3vOz%6_1Mc#H=^5LZd0}&LC0{RN1lyZR%{y!cct7a)*H0YwsJ*`OSz5oH=rDSu}=wZ|gF8a?wExVVje9q0*izR(qV%jL6 z<{vZ``H+PKMWmi(;r%?>1OP)tG_gJ z0o@!=efF|=T=@RDx&3j!eR^U-S%(1|^n+AOTZNW}=5eY0PJ~7GnhwU{%?|kB_D!?d zUAAABKla7bMv;2nmEQ7e9RG191|eefE6&0^?}ns!$_$=Xo~8kN9ka@YhElHk3G#>X z0>yMIJIun%g|4cMm50`+-5i74 z)v3xKR83m=OsSv>XU-t$THx@DVR?OJ>F9#6%f>eK0yDUTiTSaM{Bh{W_sF~RJMPHv zdz3X~L=n~dmPm$(sAbJzbG5S{3Hqov!9w^s^*YubrQP%xJam?4zCT6|a>==4Oo!Q? z;^Y$;spt!kZ{NLyHbPQ zFbcfq9f$i-+!+E-#hjzR>t^;5vwjCW_m7gu$YbH&Z^ix*ZXYXDF*HEf=A*0&w znT4k*9Estb{kx!wK8x75Tc1INMAHwP?1@7ojviu2Xb}iOUe3ywW1Em*2?JLZg=bm5 z?-Ep%lLXA!qOKGX1roucIUdiKb+!%`x)gEQ#@eHxT{o&O*QXpT~`)wl73OgzibCq8P4#32Zd&TjXPR~7$vg%Ue+BCa9;|cn9L4TLVr~aVGu@(Qi z%&Ed_VsSKSZ)}nDE4@_Dq^xmw6VgI~csCpWS>nmMT%4q!ZNxI)2j_LgEt}8%1)hRS$;%(Mj*T;kkMupl#W5a z;JZ|Hb|#|S!OCKvf<{}IM76jDuQS*l?-P>cWN>4W82)D&9n{ZY1I*;Y@cSlynBosR zU1tX>>{FwS_sXp=Mp~wBwJ(kOsw=wn;uajGD7UqS1*s8`MWBEd*3}Hz%Cb#)mo)WA zl#0)nNSO8sC0bQDO=K^JG}acq^=rZcjVh}`tWB{Kahn%^wVBRs-7L18A?M9%WMGW3 z_*?QwB)0{NVo9)hCiCZ&wZ_CURM7WS3%gCn^2`o4 zJG+1z!N1TOi*wJ@g7{x2!$BXX8)Knoh`}_*k%0b}AmWatg@3mt^%nz#$d}LWM4kRc zh<%laK~ly*AT?~N|A-^%CW-OYgYmv$LHPvwZX0|6sN-^CPK7f;dTXFUr=q5&#w~^y z`7bJFJTw_6d)Z+}YhHI&QQ3H|rqA{o)L}P7XLfsn=WDpoQ#$;#+UX0eK`LE#910v{ z?Mjy&WjxmWW4liTEXoZ zc%{fSa?1SdY_C_<<$Ox)KtRxa?hg)B7hwGA-nT23l1qE5Sz7T57suH)cPpiJAJ*g= zlrV;{)SY=KJg4*%F`sP_>MyaZC?PGEYf6ZHdJCSh;2EnsfU>6sSoug^?D>*f*RYM7H?~m6Xp z17CzLD3eYDj^=c@h5E(%pZa>QC0B=FJEh*5id2j9^ZHA^`W=?~;ei3(@NyDLs3rz^ z8l7;0xjZC!4vbz#uP4fD_OQBmMbUvYrh3~`W=1sF(g^L1L+QcI($D1?KF|- zwq;nbGjlPCP$ix5pGV;1oOw2;JZo2fe<=Fe&a|XF5Tla8d-ck(180Ds*)gGlK7UWuami4LvIwbu~2+LvP61^J~&$BOKAN++tXFgU|a)@MZSDDnp;=H_5Ko)oM^JU-V?A;4I zn*UEpc@TWi%3Sp7F*7)#l+c7nRh7jh9!-9sbp7~1dEvo(DDv;aD}3c@H8|-hPqBfC z%~&UMKbK-ltmVk{|bub;u4}%1S>C?`rWFI4AY8TQdL!j9Uh3= zlQ2yOB!ICk5}o2N34w=2>S*(Zh(fpiRulAknl_LnZGrc{e>$?gD2Lm1vFLkAsYG`} z^rVEoI=efG71HlyUBYb2y?ZUA_lM;0hlXsPnN8>`FZU<(qs~!-$(Q-E$a+(lo96PU-)8smM6-JdWMcKw|QRl?B57aXxN z{y#YO; zd}%jNi_v$C-X^OiyLD4stw|=xhFdkn!xiw}|K7E#>8A=P!F&8`{9lkE1-f)}VADOo z4^bn~H&xl1^B7B~970^6ap&ID9jm6kL>);VmW?*{!2NUf^A+6pKv>1qb7JA8Jv&fq z>`j)VpnV1OfJik}yGzL+QhT+6CeoY4E{F~$jA}fYl5TslnN{j*&H2dc^Y5LR+o>tF zjQXKdB8(fGeQK@x#X^e>A4GP{^n|PdLG=FT>mUh9`+>6-9IwOOQkna~+xN67mO(qk0BN~ zOED=$u!r*b7echZlSrv2!i^(i@1h}SQ_1=`;>Voby0bgK1Pbcj`L{j(K4b-mfEhD{ zdW5ZRq`lP?ol1YgDAB#~?elSBF-tr&sX4+E24;5baR$eXRW_VH8F?tivdqr>Jhq8n z*GWZnb(KJk2oowmc~)&G+i(5U7+rT(K{vI2{i>LaXzjpWPgV+C9T)uLb zmSVogl!Q3>1QPYM=S?0x2=MchYYhpQ=VE!;mQ@Oy5*)k{le2enQvlF`UTI+2XU>__ zPgHrKrK_XMWR+($<}9Sm3Cf9{V5|9+)ygLhIOI$UhBtROTi@1fZ zoR<#q$%J!61213F^NnXk+cEjg4(udIGH=L>wjnfSE}E4^3Q;cHi!*J%)#S_Wh)8P> z3U-@y5jN>ljqGl6$fn#!nAjBZN7%W{6iq+wOd!s$jyUO3v0AhXM6`4mNG4mZY4NGG z40#OBOO82r_Q81(I;GF2mv0!(Hk&lazTZV$*Rvb&0Fv|zMtDX3v~a6W+64b&7%o>l z+ACeEBOa|Da(zxU$Ty!wtEy=!dNKXHi>r18Kc4An@8$h$Mf4L)2A)xW3@bpm6vmEA zQ3wYJ=!F{(x|gJ84}YZWtWF$uZkXxDT`&Zab7Kz35>Aj0oGDIz5Z0kpj~j1$iYdCg z(;I#Vd@x`-rmBq6ED6~YLc(*}oR*c@osRaOp3cQ-Qtwn;i|S?N7`x0h9iW35soJ!< z``(^j)XG2B9l|SU9RnV&b9)I^{bFXu(H!n6>kL#YbUuR^=4P?u7eTOxyKur2TPJp? zO7X+ECH3l1`i-gtdfc7jPY5JdMLbyq ztM>S+u12r)_!V@x2LAZ(uTdyASSy1gewZm+qsQ#EP6MCphEpvjquHW{TlVmi-aBBa zz@aahtwuz~E9x_G(q{8S#kg3WnL6xwvf>o`B0+aW>>w@dtzdk%xJN!_n%iK2BkIYh z?64WC0GtG7fMnO3#4c*{4!~fBZsSWfLob(ga)x_(b3tO|Rl94=$Uz{&u&#T>%Kzn| zRQ4bCgJ|c~afQj7$x2D#Cz74$=%*Q5!x2=y zd#$IU-N`h-!sC;~q$MdXK8~)Wbcl$5++PP$nhi@^6v^Pw*Jnn1YFe(=L`OfzFE|F1m%y-ua@JmKqZMCM| zai=v=kd_uynPGCCdn=mFqh&fKjJYQT8i%>~&jsw_vS;Zk|-`nwbaT{idfU)J4BlgBq86%C|NZYv)|-2-NKj*w9aFJ90_Sxn;G z@UNJ$Gda=yUuA*{S4YtN*x3F50Sknp*a8vju0ry+`#I`gTmj{@%K|0sHKZigU8IIv zbYwq9Mw`4SNzt%<)p*VIhU&L~_g)Wq4Nv39SRB@K&u1A)=12G*+Iw~9RK*b4;0$+A z@3`v_;MIA9G3V$w@yH~Tw|X(xE_UQI2dcn!Ha=5N#8O=qQ%SLD}$Rnk-A8-0s+H|2a&yo`tW zJI$bZ1jotsiNyLR74P^Qb3VG_Z^_kd?gc6d(w_Q=VY^*z%B?fu(CY#b#c3?Y)`$pz zd?PSeo;cP@J6^buJvg*Wo)@t{SR^NjvmZ;Hx?7&x9@tI11>75#|)?K??)@!ZAl_;rBi%Wx0Jfhx(kAFi$tfNU&kQkk*lmx*j%7!5fRSHG!g0TY4{;-IupuD(Pq8S*1Un04wFU30<>$hi-0PV`> zILl;NC`SWVG-pT>GKo=_x8@C58D6SkgI06zX#cHaR{DxtwcPZY^l&Hn=l#^&HE!kP z{sK83@$x;$2l$A3^e6dLLD&r7J@DX<2uYaAg|7Tv+HebXT=~-nysDy}O82;_gP~wb zSzE ziYIZpXCMY68W+Bt3}4W;M^aNjM&!8uDjX272USw_ZimQyov~tBW9s2uDs7o|v%W~Y zc4cc*-h{)xEbj<{@H}FpolKlBM-Y*(6s~n2wh5T;klV{9_+!ez-JY{WV?v38xi!+W z^y=V8=AqMk%N>Y~om~KH9#Ax5+aK6FrkDDyv67mVt~xm1K!HE(l!z@ew=qj=oPRfR zJWnmpRdC&Plf69;1M>@V%A-;;>1DiuS0=jA@0;Iy{me?@szM*N(^t+)JcN!{K) zO0)^75U(kS)?H^`hiFEcAwj;nmE3)MAAVp(#fW`B9?w;fTAyNGSyGueAd(n02~FH+1i+hFdR9$SS-i+UUJxI&D|ixT;TIv<*>W#lEE?YAf! z-ab@qM1z7b2PZ>AFXiGa#z8Ftm|9xukS8-tH{7k94*(CT##_|Nlh1o%bIS}w6vWC! z`0wd6b@iC3eT`Spl;%e#nOAUUO+fupcRU^S@-eqzlwM5VEB>qMk zSvS2JblekmoLk>usm-(|TwkVz^TBM{SK_cxa@^Yh@Pb|UgP%@^ZWMR-^A@s_FrR0F z|0oT&^G?AcM7#XG_mS;l*k*558fwRhz%N5S#z0sxt!Q(0u=iM2)wq@5EZEtm687eq zrkKWVxXp((LK{WJT%xZON=z{$3IL1JFetPgv6U1?7RqKem6bXYJ}%NTnbJ;+bO(gh zym|=blD`l%ElsJtomxuTjy!if;@RWz zKz4bEnyL9->_oSAyLS;P8x!)NUsaUTwt;J7)1>a#KqF^WD8h#`qQ;(em>!rs~QzOekvxa2UN3=65WEVgO4P$Y$ z4Ri6)T2%M8ar2qqF`T$V>8We~2Naaip18PI(j-8v4bT+5nc5|2J5-K~c`kE!r@p{A zc25Q|%~lfI-u~2-9P`Cc;y2jLh`JI>kil$b)`inoe; zb?wCRWu2n*ZY-<(gXCcOX)WM|E~vR3vURBPdA%vCAIA9=N7$5a{bq)2qkn4wSl}MT zR4a(dwH`<9d!%eE2vN1ND|(0KQde^}D(Evc{%t%}IpwfC7}gFeaY#stsiW0nSo%A* zXg5Wr(OXVDnVE`~gD z7Ov3FHQ-n)UdAc4Zk0Ko1)<5hNzvgwIhkOsr6eUYy{Fd@$ zLKQsGL3D1E;2(a-zXez^l{_<5U(r6=skS&)-5Adhmsj%crq>+~nJl^x)r8)$=7r?= zX|yvQtvos?p*kzwqBSj*xr|#J6gj?rWl}84C*gNZAW|N8HJ-niuzzK$!L6A)7f1nZRMu9hPF;tC}x_k)+ZME zd@enAu}t8JW`zW;P@!=rjMKe>M>gZJh#Y#Mmp9xl>83!uI!dzEx8PT1OKf7kOP?=W zOZICR=FNl&#t%_|Y>_dxeEW(*-S~A87?I}WH0!<{~FUu%;_)7WpcFQz3BV?M=2~# z#icqlkts!eAdn=U!MskIy(_WX#6gyHGtkj}H_g#O(>)=?qaVjxM_vBxZ2L zx+R(IZ-BbgdP=O;Qa z{&DiacIydU@)Od#AL{6=Urogyo0^HBrgb4N37lkd4>rv7lbx1E?ZS+ut-Qd-u%f}=6`0EvGSM-hGvX%uFGf;a1@K? zvmK@ikt)`~FLV^%M(GHj$>k*P+V~%nXtlXxSEP2;A`vrvg zTbMqL3vM0%p53wJl1=UGzrkNK_t7VRh=$smEFdpfc@j#J#ic)nAm5-rVnA)XATQx$ zUE-pl@jVaMWV8<0v~4z7>CCXMK;=cD^WolgL6eXqQ)xLE5BVq7^KC@G_!i)_wBwB2 zFgDnas}|HpjIJ97;X?%n9%GV>v2K41O2XOhsf=KGZo_h(7-=!z zP5B5x)nuxmH4`j;{>W(cV%Gsa5-tompKsVj+%&<^SRv^f#T8MMTc|j)FR*i)b#oKk zVZwzLvv@<2sJU6G84_nmu@2=3es*nguVQwP+}rgp{4mYV9eZj(w0BG86^1VMNTLX) zJjA45Je`?*&<<<8AcsWsvijDP9irnTb!4;SsKtsv!NtS#pH>In7PM>GBy~OYD#zR9 zOENmsHMNv4oP{gl3|tD%224t?JAtIH!<7Rrs=+TP+u$Ov*nC0+M*~s%NQ8&XBYr0B zBK!B-;8iQveF30CvUWS!Z56i9An8zpuO`42{pYwKiMEAIus%?v9I3EXrflVi4C}66 znJt?>#l-dis5rU-Je=_VlQ+Y}qRE@2x|k6xFH$<}c$S`I`UIjhzUGzNG3474>W5V@ zcVE*Z20?(*RC|_@!77Kq>9JOh9DCRL>0ME=kwE`Z;PREie&Gw+TS?;YQi~a&<0=Y$ z!}Ed5m?6T`7A+76U`*A`l|f6*-XPfCT`7)8GPLOwc(BH`=9?@b)?V(~cGE6iEJOKi zJZ;~`K+=7?Fg5p5znz&E+$TIVMv=1FZ z_S0)4fUNN`$MZxh!Lcq=^wc1kmT&>euBUTs-1qcEkQ?QKXlgFD5Lc+aiRl_Ey$j2n zm%H7lUr;#l5o|C1dZA1UzVdF!K+Aesfb3UiUl^&w8_z$61&k9Fm1RqlUn#UInya0R zpg`1OnI}#5w`P!px%k0mT$CN7ai+lj61D&+`=#j|p=~hnA=fk_B#$6qSb}yQ_Lj2F z@?uZb`W7f7SGy}DA>ZrM2%3>N;6xm0@_8y#3i+jiS`MvbN_mba0xyc3?Tv1wyjxol zZr8zSEYpKInHopK&N>VHgF&<9J&+e`D0oH?t6xF$`#~LIhxUe>Bk^!-g?m(WlLfG9 z%V8}|R^BGWn>)lLutIKTMwWV9zJ0Zf*&$R6ZonYqw*n*rl~~B$Ofv06jmAYXi*FRB z3?sC{H{oY>k)6f+Hh1`Nwua7hOy-i|Wvix=p$|vVpWlU4{B}p765(lUDu%o0O(E_+ z)i==ooOV+nH1}SN=$NZBryF;cBv3&WAk{bi7y0LaIyiiV(9od7z9nXQZw4>mEjfpM z0I7=)=}V8P%_iSistJ;-ou&BvSWIey*!2TSJGkS}r-o2rnqhDtP<62S>b$2JJ*vRJ z{4PK1eNp~^hFZLuJbX|U%(Cx&4xX`&uNjbp*O(3;9~bo=q!ZD@{6XXMz^iBCPKj=q z0(B{u5H`ltqt0JRljT61y3tJ2o-j>qLA_YA(BAjS?SZV!CD&hBVqe5)1cI1RV z*Rznn9?%e}-O_e@*lzEBm6ZyUD%Z5w@oo{(QfXO=OE$MumY7;!mN-+8)`;mIt^ymD z{gQoiJA!NQC7$=!$jH{iL7=3W)s0=IO>(yV9gKVs??}o93%qd%BqMHf)`2sNR2gLXasEP z$wU?M!mO$V)&3nIQ9Nfx?fmNjjxrhn*QcZDxsz>`rN@RVM3O`W%!Y0~#$MG}1iye} zCL3kHF7y1;#To0X@czm31py2E-MeL>CL$VnDioUTstk{Nevj0yOeOq9H>5lTUJ6*g z_l8}}>Cc6=Tnc0LPvu)24IIg7yEi-~#Klv@LzCIUcdqx(09zG(G(RN}+W61$^48M? z5s~NV{RMTg!95=jI?ms=5QgCq7Hr}~j%a9h^>jsXCSiPWZSNQFL?7JPLlWah9Y%@g z8YwyOaX$eKcn}}uH0Q96Dn2YXV#{)~V4wSvf^nKeW_787O#}MT*Tu9F%D;JrvzIBJ z@WKB6927F=^{ z86vs(;5}sU_a!q7s^xl>HGQG-7T6K#PsOoXD_#EVH>EFqn{C?;izrV}Hb zcKXw&V3#LyXUV@R&afxlPKcj2i4I-^iW|CFGuGvxNy<e%D=(y31~dCF%P+#lphO^4?t9o$6HvygB90+5TU0 z77aL>@TIx2kxY)7;-g9zOyK-5JNm&3TD2F9*(Km(;lXd@{pE0V3W%?BBv zgM4=}#gSD8x}mI>DnTQc%PSw6J8v@j85VvMx!&(y>&ccS>?Qx|gBLcZN!2=2)bGs4 zlvK>7pBlf_@^C4@W#dt9wHnyqaxCe}nx(qJr(*Fr&yU68?-a+ft^eg3zs?8zcXjgr zFCO*j?&`Gu>dNZ$J&2KZJxQ>|S~Yio6Nb-TjIbfAy( z`sVT;-9G4HaGGg6Ec>{tIAr^TGfC delta 57354 zcmXtfWmFtZ*DWDHAdui5oZ#;64gB9oTX1*R3GNWw-JQXGF3-E}*S~75 z?yfp@dY?MByDlEi|K)u(B6h+#CI;Xq(uEK5JC<$`l>7Rs`EUZuBqZ5<)UYiF{k>gP z5kH9z^LG8ci}E*z7u-IB`rM8RkgqvrdEExt%Lvg31GYiqtvi{m*#(7ILXyEjQ#1naOe#&8HUYmVlY zhr{ZVll**+6$?JU{6%y=_dJ_jXO7|J4jPYA-`NC^=U1=(MX#?xmt&-InbLe#%g#GF z{1hD{VWH_w0;scJo=g}435&N`MGjiJ{p-$u%g z6l3T6&{TDz(eixdh*d`HW4V2aAsLw>KVaDRbdr|FXY;wUuJ3u{)_uM&x>BkAY%JmU zIp&!tB9oO{sNV6H*e~~+zFwy=Apy+EAa~ni`YPLsSwo$B)5@3Ype3dEF^89g>vYWM zn0@ZIn(dGQT)<|GqNC}Y*bgCl0otX{E#Uht=Gf3`Gy~aM@uwz7Q;4 zd>9`|zjb*$mQs7&NGOxuVmv*wIET*iQ>>PBZ-p560#~%aD%JX9uOPq8tH%n13XPQc z>52>V(*zNJGF6_V8LJCX{@9!5e#TyRn2uk-O$Z<4ZJ!_J^6sK`+~)e7>YsD8SjuvD z-e=<`M@)>%;r7v8fa3*RE{-!*%Q4Q+_1umtMg}5L^R6UhoktS(wv^ZO-8+5=P#U8L zZ_R;$P8o|xfu1%BP2n3l{ie;y3OU@|f#0_67QRy{sVx*w2Jw(GUB4TvBKef2a#Kn! zS7Ps%MAV5-F4H8?3uXs~_2*u_T$P03WrvTvpcfd_RnMw#C{a~&GHDTJn79e5&qWpXfd%;NNS8WT{928{~Xupl*Z4`$TU;Ge=~36+Q8|NRjf#rR(HIdPHLbl-`DNXUlAM}fWViG*T29{P9BPy9NN&J(br$_v3ICF`7S9p*ma zpT}qc1)Ii*@^O1KeSFx1_pbd`Zixckc%668#%umVp(+6GE2;Q$t|JrrI9#4r< zS_yvE{B=98akA)q=Kph#i2qVhyMv&7iXmUgX`sZ z@`FKf1F2$>0pkRQKye5kq zWll(>_|p6B-yuhgVvh66YU?l&^D`IsUZ3uMBvT(^KE}w~X|fS5EcCdHnx12U`L-!U z!FBl`g%yjcdDO%_?|mI4u0^PuA7f5=3mFI6I1ioeefOaDz6iXoM4X%hw)r0}WNAgVIiD;$AR;R`gS`#j^Pu{t`7iZ-Hpfc zP~2anN5yj?tBJMQVxaiS`eBPhbAQ~Ta``1Z*XQBL4EYkPIYp$2nZoMkJjN(KH~ysjN3}nVhTLiO|(Bk+9oQJCaHAE z^gExkTq)vG8@Fx@*M5LX1$=i6t-nw(=bisujM~6&8>$R;;mJ&J@%wmn=J$h=&6&&2 z^R_aP_Yfk9YC9RF-6B7~&ig2UfLh-_i@;r|#Y(Vn$j9$$k;jzWX*D6uECAVHEW%BZAJq69W-&Ku<9^=d&6@7&QE52}G7qB}+?_eR z_!|(a-RsF+*@o_#mbo{cHf{c5c~@-wuv$iMP_oGcY`K?7S|;(1y}VHLq3b{OIxB^L z<^!A^+Fc*|9Oid9V$N`@Ot&jW_?nKe?gZ}YTDITQ==TvapU^ynK(b|-8nmU%XX zESjTHp|xQL?1ht($a8}A&zm7xhh<1BJ1D3|*k4DaFC(H~msk%u|0i|iw>Bh3L8|km z-I1z}n=qtl(16gY=*q*|qV{rr2WK$QoXc+hpvufN0A0V^)VIm5SkSrJSos^(sUds^ zv3`asG7@w5jb5H=+<^Gq+}GSbYoCt7!br{Yi{FA^Q)srFr2lliHp?Iz)ukt~R&v6IQwunBNQWn1Yy zK*<07FaDdrXyIaIy3=N7!di~?C3SgqhWva6YcqydeaGO|t4Yx7vRBLF+m!c)ZW&n@ zb)d>URFdXRfJ@y44T;0qaO|uJaGh6Lw{rTkSSWluoCkis&?1SObGA;WYkc0F%ofni zk;DbLUo7f!2|P(+PM#h({BtE&_Enhh<&>&D*G>3o+OVV3%pD{RepuNWf1SoAc{T3|F1jlg+dNYLPw@&^ z{l*Zq|3)x~pK{zq|2O)JikA?lDwQDe4k@7uixBWR@51LKclDGtNBQJSEz{oIQs!jB zGrewy!Ea|jl#4f)h}LKDyf!9OO6qGCCiY0w0bVCb^DvNAHh|l0$Hlu`i7#+s%7A~f zpA@E#X`d*gIlQf`;dn1loKcRv2@|a|=?BY+Lpt-aO}qZ>=E!0@Bhz$vAI~<%6~PyX zX#zbZsudc{uNlK2gWp6sm4dTE`Sy;BUktFsWEec%8dv@`gXj59ohFUhke!qVUZpBd zS0t(^;O@@og0j^ZHeQ)u@u3X+xh(35Bcy9Gq5YcyxSqeu8cEj3GBJa?&FXdS3H>&*Y58^>V*?=oj-I7Fwz9!W%+8N(64$Pqds^R&eP#jf*moGVglqPB~3H z1`N+QVeKS+!SFTlbh3o8G<28RfWl}u{_dC~lV&!FXmQR2*?x6g1Q1n@0 zf;D{@{TN6w*2&5=S$%fdt#thaWfaqvZ;iW^Bhw7;(n*VhE^3GPNN~20DAn3aZgUL8!f5Sa4Fgdv%Vm zU`p~PR65R!hct!!PS*uu&-xG&L7W;}>IB^O2Bm8KqiD6*#Nz*4T!R6lxyH))>#zZuKI(VgH^i?PVi!&?F2FrAplnpLaX~ z&z7mAzzrPCO#1QOfNgIlqJgq_h4=VRLPA6=XavpHv+J@dUCuT^h zBRfcZ&JjzJn|(ANDT|9rO8eyEHkAp|*>13Eju=t*II}e-K0x$h%Y!Uce^=$f@ z2noALQ|&zbqJsgW(2-BnsUh0_GV!3WfdB?8MX|twJV;_uJ_aecdl;Soh85c61}+8muLu6Ob0PWObdsMJSYg65W%5)AnWPA~4p)0f zCSRtVCuG9HDN>Bw=rBJ}pqxTDZhyu}*gcV3Hb3g z!#I_?%|G~(Gu;todkHEuv zMk9=HsKlLM-%Mwx=l^{aw`)lr_S5K0aJHhU`3s+`bmm%wQdgY~UjV({-%mv>?EswK4 z=}AEJ&c5`4NYKuXF6}wZ{{$=iRV`#L*c>s8D$&9)K}2P4ejfjVAV)$baC2_0)vse{ z^O9PF=pO5{RqbIfpTNR5Z}6{s)9-Ux1_9J!3}&f$ZW|CS)tyoa7hDS)v6?#q1eKb^^>%gKX`97 zf<%kkfsD9|1sXCkUTXeXM{7#wZCBovgfD&<$x>p>RrB(u1Q)O>-LwYD$ozy$Ej7R& za-#6SMIX&|@)FP^1%(1ul4U*%n=GWuA-62MW_JOOljVnF5_m7?!7Lm(&;SSp!YD>Ja zC4t%bgQmkqX2(2ML3klUs73Kz3_6@YHO&p>4l93`Zuvd zDfAwxa`8~+)RvtV$Nl=-xf=SD$g!m@zYyo7Z2z0np&l~wVjVarLV#X)$#5J!xCQ~8 z(sL&_-woJ;#QN|2rNr0j-lfh5wG@6{e>)5HcFn=M(-B3iONl6lE6pBEpb8SfPJ>>8 zYNJR>@@`BhB%&L!2p$z}MWY9Z)g-1zpN?x74<-?nr3!d|9x6vVx#DqT*}53|ch7R) zZam^cklJ&oqS)(TJjQq~slae=lMQ>yH>YyAn(7>!kSN>R{)n$?0wO2w_c668va2dN z{XHKV;m#8hi;7Z}II{r#y#xMD$d)`3&%M-338BEj_qcW(+kPin10Qw3f*vgmG7YU#XO>dL{KL}Uo)UPMd-)meChoI>!D z5g&z!l*4fG(K%GWP{ACw1vLTd+vp0+s)5ZP3!~JE4Vl7fBf0ZB#=SLqWxAtyb8aX` zuN|qzy4!bz=RIE{Bf??;77Bra(m7r8lL|b>mXV-=vP~>ga=I@{wOf-9k!FnlsnfGF zVVPO^?Hmi4Y#ANs>$0^DpwPphAUjKx+zcyFPJpwJ$Sw{bkN=3z6#!lPvSxG@o6Z#ceI75nm~M`h53!yTDlb-eFJ@U1rNzn?ji^jBFf)-8u`BCP*i+MR%SqV0Q&` zu%UC8#mu<#=Z6DRrtgSaP^_Z@(qrk3K9J{3(xusYZ6N7p(IwYfF&JZkV+Hajqriee zb}|*0AM19u;*1mU{1LeXt0z8-XD8yM$C6s`cwPTG8>VgI{MGZ1T_Oym7+sLs_KD)0 zIIF`s;ljfaVcg!KCA0z)UiQU3f`i)dw+GL`4(~U_Vyp&YYY@Y+Wxmc25H(coTJHrd4 zP51uXlH;1B>KxUL6DEx8nwhONzVq=2$3@g2y)iF3vwV5g$WYvxe`-!w`+QhoTrYL}kEebQ zSGwpbtErT|^Ti>YfEZhy(?_`;bgukUo+-DrSf1pZ%1-613_Xp~3wMQO2Jw!fQ4MO= zpOb}?TI|?jrk0bD8n0^0X`!Jbs~EJ}%Q^T_j1mpY1g-4TTBZtqEB2CEBw!Qd$uDU*C`lx zg8Lj&dxto=QvTU|x14kMu&*6d+~&=@{P#2H+&`EwkLiz}7|~+i!Td#?PK1=PVI_Uf zFAJfH@0V>4PCedxzu|wOM6}jYZbgz-phRR7Hok|zblS_$hRup1|EKNCn-f8uc6ZFK z853M!sF&CHDZTf7?evwI9vn!9hg=Y@ZPhaBDeTNxF4`NQn5FZg>N>^NV zltW%kfq}Vr@3!k|^Is|gqt{m%X%G5u^pgZJ4x;sza%sPnype!!|J-RT{6r6jFMppz z%7lF*#mOZh4$u%To@|=sBzm|Md6`tTr1H6I@NzwoL`;hc*Joiio4qVwDPOQ;WtJP2 z+z=bL9DA>$3i4f#b~vJsaVLEXLdV~NT>*{}Jchl7rgDR;1YH%gFk6g-Fw1%tI>r0`GLBR3#>MP;i?|b9b8nb3Aai+y@ObpvP_h+JF<{4q3k&n}e7O9BMYkmc`g+%} zBjE|l8;&j|`Tcj#{@HDYm8P3e2Sm9;$6I+MSg~UKuK_^0;Z0^9Yl#@SdC}S`uoPV> zU!qkK*!0p7vV}P-I`dzy>b(5{T=b`le+sW6tMj(50eKyUky}^ zfd+eHI)AgU!J2GflT$iUkb5lBhaZ2|L_Lg})?>-Hc15`Lhs};6z2HNSV=geBR;65C z^Om49+ycy!{;=@DCR0S7{y zE>w>}?-J@)bkQXJ|BjLeIg{sNhmD^a&M7`ny@44erDEeGOekk>GBRwb5`HNywz*Fff*jcKT&m`;#<&f)-(~1!1(NhB)6{a!f*=3w10Ihu z5dtQ%M+*6Vct#vXx%m|x9YrACK3mlpYnl{D2Mce8T!MNDw{c1csA#k6!=q@Ld0%A< z)7`J9v)f5*#8CtcZrLaXfF<30x0Z)0-Sw`DBwhth)bPebARxdi!HR}~ zVf55(a}qC$rKjln+9iFAii>~cJDz~ob@ewIItB)zw%^+B8)KMlx3@F&HO0C0=~-D| zIZ-`Nb3wnYSxrL4jh9pK|K;8qsrr(;RSv@uM1-`wpV~;C?hCe`v;ArSd-YLIe(SUK z2cJIb53Uy1G-+7ROzNmwDfi~ zAD4vW?;xM|ZB$pxnc}l)k5MhtCYLer+AG$_V&O0d^>BDccR+M{hRmrM#Z`Xz-j2D` z#&?dKsqFu43D2#W(!>_JcQNRfjOyXO1N$k#KhCy>gj3UU8vr%#0-jJT?2*q!!dD}+ zLQuc{6M3MLjSL_qP%*`U{sQukGDYxG$RfiU3t zr-;b$V_+)b&b)o3v2`2QYU$8pbuov%*Y+o(Lf>P>QsOjV;HHj8=2lGLy1WQ*e9`oN zt8b&cS#fzPkhoF)L)l6$GQ$m@zDaBJ<)y+oes;)lS>f`n_k+M!>P0 zWG`uY5GsRVJ}(G9TB%u_72ee;tivs-xkO%Lcz@2zH_87U z&rMI5I#o1B?WWlJiGwy5Q7U%a-sZGM_@y!mnBUS|i$U5##}^eZm?5*9LQ=D=uCctweRS$x@@;#vbE%PAifL=x z+_6k0b5b{0PfER^sEs@8xU02+0ZS7cT+OE*vC)+>l!~@Kds{YB;FaaKQt|h>QMn&n zP3|y2VnB0C!Y@g3Y4l1;M zKFqD7>Crv+gD~B+KwXt^!1)me;ejl8Q7zO>qy16GCL$W6u6zd~j4(w#KCU#8jfcVv zFnpOMaI4lraZq1&!^OdA;Z-}LVWCNzE82Y61% zi`K!9ci?b*Klfv(4U-Q9o;<0Rc>NA2!=;V!)5@9&+sAs!W25nvW2e)3-l}T8sX7Bp zoT2yvh~D2J%p@`?loz>(PS{O$mfl-+@ABAXMFvm?Vmhwd(h}sbTtT-1K*l*BJ)V6a zaQU3Pd~AErINwC^*bZKQglaf4w;JOn7kCe`9&{`8E83YFWOUYuYNc^jI0Bh_n3?PC zEBbX4;b9M+N@kUdG~c(#=GW#AOa?LIf6SZpmbHTZmj@ z(T*c8u%5WD#^1{pS2JDqvZST2E=of{_S z!%)ky{f;vAnf&scVLdmO7w?tXJe0ABCh_F#hFM*NlVjmzd_z8Jv!IuumFkl}`- zCFV8h#dS-lt~S!4g?M(XjgOD#Z{s!qLcB+srUsB#3KUhmq&x=>HcS#-SCGKS=w zyL2Qax^0)Qo*GjV0KXR}&;C1C@3N6~??ia8uRhjx=8mVzc*lx?}QMs{#)(VHx>m z5_7G|3(BJFy|l7(m-|9?@wlAkI+|~ybcO^;7?h-6vIPtQNNMC#y1M^{_a;Zv7lOj! zya$(^BU_KdA+DqMHc;nJd=K-hRYF7IOKNz_B&NoP)AJRF8MV5Y`o+fV?D>`i`fK*H zOcg}DUS9bA9Tq6Gtp3RE7+x&YvW=_`L+f~Z!$}o@r9eCrtWi^E{7*F>j-1%3S z?RuacvdDfIceNo9`lO@A?AC9sr*d(zJUQAp4r-e9#pHHS-)s>XSzT_sK`-#_S)mrr zziZd4ds&m}8qe@Brmag-z8=i6G#6j?23uM&&;#S?0yZ+}SQ{g6A&PBU;s%2l3D+pPGHtauGa1uPEetxTiSat)O88d^S(eDM&b+0Dfz%I;-x?! zkkI0n9PHaOyo?)q!O093emY3VWaNvZAMDMa`r}BpwunoXc75;FrPGJ1J$#lRm)-zA zjauiGPo_#_mQQ&t=1JDR>JJCnSyeD50}NN%lLmWIlwN(N8-%F~gP8SStLCwBg`N#> z4M?+fl^XnHFMI!Gd_o!7WZ5xUh?nUE%oL7=eSQ;mYn5zUSl~_oudZhw&bc~jUN7+Z zvKHx}hx)Sq<8$vz57G?>$Ggh-3O5P^mW4~$n8bT~z1PO+DcQ8Hwa5p!4j0ID6h?36 zqSKPfD z=iQ|P$kA)dF15lDIHtx1Q$gdH&+uur#*$*usQNThPIsSYQpl0(5I(ucGAXG$t2E~` z46>cM&GH}8LB+k!l7ieBKnyp+=qo9m8zXs~pT^;7@7b#gCQkdI6WfEK%aCU3MJirv zldhNcB;Ruy?%f%F2u)kC)pZioZvE~^g0jZoA6 zEwF8~i~XtHc^eGR`4Z{dnOr4w8CbdOrfrl@)X#PuxVgV&WIX4ve|24rD~Ct!UpHVKq(Va{X3b+di{``P zOXRIJXJZfFIiu)rimL3|=4w&?l1{i_NGwl!i>HwFSLI9pU`V|Ghs^O3E>UB2^-nM` zbygbw>}88bdmhD>r6zBAgI=wvte)P=1M}kP?Vm1ubRgANy^GP~^^lf1frC(q_^9fB z!W&yDN}<@WzGU}Qm&EXgTRx^>3D3%-wr&Sgj!S6(x#XYF>}1E2h7P_SwzD91DHlG& z-m%y1qkZnk(+f5dL^ekZdlK`^XQ{mD5_JieeIk!KE03Nfz%G=xYV`LHGFoxq&|C0>2l@N_uP^e=JV&_Q zNxtza+w%yELq<@OaHGS@^g*k(5s*mysN=~()$zRvJw*Xi;dB13f;tlk?ibJ1j&S6C zGAljNeoiER_w=JDWI2!L3gEK~r_^b6V2CcN4 zzf%l%_%C6?Grm_Ll{*z-2mW{&*HK7^=N!det2D>{=^_$TD4;mWyH=umKJ>jG*<(va zR6xjWBrdvsfxUQDdYUYeDv2pw7An6lzG$G!lg&`D^*dYR^}SUUV3So zZD!)xeSv_0R!!3}p(4+!goSZ=IbbAWCZ>A1fUd4b^Sh7r+j(l592B?D=vc^zEM7&~ z*70LvH>oOG7%i2FPP(r#zJP_0-O}A8zJRpZ`K)Hg%Hr1dzM^j>E(o{}?@NZbSluP*a65%G1yRoE-VUD92$T_xc>t;(lLbnNfX%m84u+Yd+M z$}4w}8-{jTp_S>og4HWMsCaq-PFIN+d4U z`;T@)xCX8X6)*k`)?Ds%nX=qiimov+DKp-FOVAMNb=^}EB1y*Kr8HAdnj>r zP@m(7vVR55qa7)Ktx;8vY1c~5h7|KmGWlapyV^4E4kxMja+Fmr-o1+Qx#7gyP|^QX=s`%{}r+x5Ew@f8cAj^TgJ$1D(G z@2a6rd7me#@qE#b0h*6!4%0nPSy9GFTUr@dtpS7ed|qoj4@XV_069RzxK}&_Ff*>&~3`nRCrdb`w{E@m15@iY^PN!oXSkxu)~FE4pPpW`mOf4hz#d zBn*6V;J?^$2rc6z>7+Ir>u=R>I$gFB+k(yVs89Hfft#9ayr8#YkM4{N2)oN}Hm~MN z^;JBin;bLW3bw2P4ST}V37&(#zZP7`?@0eI5_oRh^PiQ^e%d#Tr=1ivm+ z2IelI16YuYOQva$8oJsJtgqQr(t9ayYY1%_T2GO!}vFCWYxA(*5mUx@oicE4prkXHY_zQjmCcFL^!lWWe)Z zkTs`-f(5gXw~6yJG(tYphgqgv%X|%7vL{tll65vk#*8BsfoSqo8SbjPc>2V+bLrZP z`CE-!$PuQ6JFz51rS=tUw(^eYu-Pr z1mNI%VR!ypob(;c#${Z|jP?VOQTBwU?}p{=u;-)z1Rjuqd;shhEQHsVFGee3Hnj^% z_EC0qIu<$xTRsaBPCKz;N8A$G8q_I_M#tt^Jr7c)bh0Rv9X?+6x2^xI$A{VAXVLA# zC$DUD=g^ontD@bV>^?Ng;a50%GP_(<)b;lBUY=-pc|V;h%wcmgbxUpmqD>yo4H?@| z@6aSnaBsG{CkN=}%-x9uOWLi>D1*qPD4XM6MiHIM^!huF&wcZh%p~4e=1=CVJU#dg z0sPP_TJ~QgnOHp^O=5xXCeKBCQpDI?&7M!xN^94liUp~!{$%Q9$#uB=7acNKe=R7A zg+3Wpzr;$cMXFWK(f-D>OX2O66IA7EMdaTe{3&E82-N0_m>!gQCD z`E-1Ae6OuS5F;yP6f0SGe?kxgNvYjK6@D3;n-~78cNU>9PBZhr7Qw+K{oHQ15cFf! z{E|P4H{3wTh0fO(5$616mxWXoX%k=|8CCH1vJ84xF(TOGK8pbJlXi3t{++1VM7plm zYWIxZ7s-4H8Z_id)ELn+l9_|$4r90;BK=;SnZ58LR34H(AQb zSo2wjKGG)l{E3U3HzJy{d`zD~NXJ!%Kb$w0#~Yl~2QKs9QS9wf8S-;eeQ9|lP$Hgh zgB_`ZW94-!3GMq67yH3kE4Us+v}zsVKFVd8i|1(`N!krYN**zqa+`Ov0WGxP!%e|S zMt{cc9Lpg=ja(T5v(`6?wbCc`E%4g5TRAP@+vR97 z_v)77l^scEljgw!YXMIeQ^SkQI0MyKI&#ks%ZeJs5Izx?9AoXmlwaUre8mjg6W%sM zN)0D_QKmcFg-Bl8#x63DP1Dkb;o?KXzBGCP&To1A*KXRoncKASGdK_+P$ff_hepWf zTB;o8kkLDyp&L6c)$`Ke&2LLCDO!?(W2;%tNUg-Fs6qIj@=`w4CGzG;?2IzfB_h8V zVeb9#D6tjw7f=*S-$S5nPdO=AbiyZ$8NDbTkuPK+4|FV$T(nx5^oZ{bpJ1R-N|M-0 zzcBtBDUnwr!5VJXG6X2sPbT)7B^AB>)iG$huqno2ZyTw`QiEa;GR9|m1O22;w2*I> z>+}_J5;vfiBO!t;l)hYgNCr!gCPR+*=|$#?kDpK7LhRH=Ot%b5nA%^w3i_5<^m2o0 zBSHhqj{$v&vZ~0&&1xLH1U2!K-Le=9UAgw*BIwkAlrq8x#`XYF<2$>ag#)Z*89Oaf zmiKR4>@=xM;LQu&DWSC$So>kcN1$|_o_WuK5j9}uSz|?XD$5{SDFBP=rzcL781>@e z6*`=RvtKAjgRVWK5+%&oi!tmRc+aqwv(_&z7l4WSv-i;KqazPL6}6&LeuKT<-}>D!8{RDRsq6&Y1~NO50()x+4W5*Am#qro;z^F4v{JT5D+TcIz1d&Bdv45kpEYT2rG?gv z0OCk8g%lv2P6h zJ5GR90D5Kv1eW}(lvzZ9#PC?oB+5gC9OV?b>}xlDL(e^2BTE*cfFc#E)+QE|FU0mt zHe3p>PK7*fpVei)G;EMwj|Ls2aN-FO(*IyQf(i6~`G~^#A7@i+w%l}Fre1_Ov&Xst zluAp%u7%!}RK)hYd&#G;FO_2SnLf+hcoHorXaI*&KzL_8c!bY~YvalohcLLA<5`^# zl6$Nmy-oW&jn-%+|K2bIa0BV9>P|EpZ$ePL>qFv#l2@?uM=6s;IBkCCrRZCQ zQR58nXoXG`i~AqK#b(}09|oGFG~ZbOJT-ws&O@JlLo}A!_JLhgV;K(e&*Hye0wfA1 zpNB|CqwbuRp^R~7R8y?>Ttipfoe4)WnftZ*vmV=SF`3)Sy~FdgaEgz3NE95Hqw%ZA0?U;SA4 zwjSGa%66TKN#2YVr-oLk8AHgi*Kp%nh6(40$ojMwTo{RoG2`2~Y>~ zv%zLcY)jtr<1mlfu&0mpzE1-5n9%QWb85ea<3TNbLLN}iA6tThZHb?0#mhq@E*$)O z(Wz|N37Uk5Su(OXH#yA?)V3B|IU|x zE(k{pr=VV>XwsgxxH=cB6-bh4NlkndIf{@91ogg`5_3Cj4KmwheO&{TbtK|{ayIJq zrqq=VPbl4d-ioNn=XFHyVn+NE=|WBsUR`av*$NM@O(EGQE;8j=aO5z>hbB&HO!~IN zH@5#`3+dm2V+}WFY$S#>2G2?ce8NT}Q-P@9U`6#=-9ksuPw(QU%4}VNo&uzJ+~gsB zCJqcG&x%aD)z{~Q`F!Ba62sI&@*DZKljgwp&&*%{;fC9$EuD!NM|MZZGj|2>j~cms z5AEN2)MT@5j6OcSis6+fdrFXd&=G_wZ9Qck~cAYr~r|R02 zq2%51n#7KSfeHM=<5Nq=u&=P9fx?G-HTV~7_12@?-Z}%3yy6@q4*|PYD;_mqLY3uu z=!$wax+i>#EQ-!=4u7+MOa3SR^SSeQ7|pqV54fYcgi&erXucMDjD5Ok$m3R{aLiAQ zP=V*Dq)e({)ut~0Fnx1(L|H;EC!wPkSZdbInVHwL!(M$uA~>5vxagQR101t$`H`&d zv15jtO>-3&M3^kR)hXY8#-oYs+amjK1cOHK#~nGLCIK%YR>>!UBpDOncrqyhjZG~ z@Bh-;x7#DZ0~Vjtal|-a{?6Ln`m(&y1O^4Yt(-z8ls&PF=d|@DX=7N5MU2CzMl zoR@>gUZxes>a@ziFQ*NSja(6ZOJ^1=cyDYAg#Zy!8OZjJg`uG#@O_^W(dQ3oAa;@r z*6utj7sZVl8b0o(>yqr1Zux}ix5xE@_df4~g==Pr{0xdpP!$|`8KXCUAv0-dX+7V8 z!NBc|s*<{2@5jD;-Wc>@y$7JD9q!LK?l;l<>p}gQI`0OigJ<&FS9|x@c6R zg&odoi8E^XLyF+A7fZ5$8lbNJFI|rQEzzizizpzpe5nwdl{Gmz`RlDH=vLp*uu1*v z?S&nXrEGqj-{=qfc8-ry>2LB!D2Vkhr~cipW1N6{1L5iE>3`b$K%7xfVD?9wC80}u z;ozZ+ITGGI4IXBcxIKvXNtePX!E`)OjBLdU2ZqJ_0>?bb56%Woj3$9a3IwnvfYC09 zAfDX<;)DBF%J(!Vev}`7mc+^!nX(~4af9fp=Jz2U5MUBJ2x~9myEnv|Q%Bao@IZqZ z2G<6%6@)7A1F*KnNFEUvMlr7|si=4(*{m;tp)emmX^Q-iaTKm)7ga>900?EN}QlvlH&&(fEzDC-nN>B7BeBCrzBP0M!Kk-vZWB= zC=XBk5nsE*Xl!*Rf${ouKx;PB1@14l{bKD`hjxh4_4|O39C&zV*^8Zw8TcP_3ogZY!9Eb_tVT~cKH@jvnC!K#hUVcZ$ z_}iPE8gVg~&R9QN*f&94od5_9RlTnxDmqrmuJmy=qs)~Bo~?JSo)3$J<@0jz(Nleo zug-n^uGIu+dYX)`%^f3TF1 z1NxA=_Nwtba{R%?JUljFbBwglZ}`|bz8eqJ&;~!b7*8X6f&E}oHVIH08A-h7;-4f-bLT@+T`c7Tv=bl=X*JZxg5G8?|#Mcj~|% zHyoWJQD~G~d%||-nR?ypCE6wMIuU3-u2E{$Lqu)B5xzRJ5l-5i?tDHCE&_jR`{y2& zRK2s0T0z_WL^4XZ`=?XhPF7;$L$soBmHV2Y7G$ES>F(PU_X=<&q8!-bIgy^OSQ_Wi zCCJSz`r-9aBOoXxY;>c#1=hf4v%BHSOu@(BC|{5_BEfxo+dbcjy3&o(P;nD6{;E>D zL5xhi)Q%bK{_W|d9z)a(>WvYeTKD?exef&v_2`va2!*{AMu*&u>ZP0bKx4H^3IHF4 z<`+tm7`x(ID(b2UMSP*Y<5utaWPU3B`TN1+=RY(j-a`7Q6bLvWnJ>ssog?on-4cFl z>H*~JY`h9+L(w=MeobHPYlCIbw+knITf)WxXpB&Xpl6+s$Nf6+BoQWzmLzz2g&pQ$ zKv#RwnT;8TKXndW26w&^le2%(PobfVPJHy8Sascw;TC#KF4DA^NKFtt|Ha&yefjg- zK5Jyy=$v_V$*&^nHvuv3U2woqXx*}Uvl0aHiyF5!1WBqhZEkFB?iiX-USwG$E`Kmx%X5}e@f zkl;>mhv4q69YSyqE(5_Gg6j;y-QC^Yede1y?|I&{&RXC6nYDVls=9lscGupuue%ng zveJ3==o%mj*C&GAhFr6E$)pqNUSh(Pox3ho(=Zm=l?!vXXB>vEP0+Yn>L_eArB<6@ z+>g)bWD;4iB z6QzcUN*?S`E(gi|Nh4y)`TCw)`12+eewj{smxLzLlTH7oi?k{0#MC=X&`z$(_^CZ% z8iR-AADNkc4936^L)c|+ki&8Yo!-S?8hwkw_Q>aq+u>7qsn;+w~#h}bzQu~uF$teqr!u(hAp ztaNVLdtgSxJRNTo1<>EU6FoQz3CXBkBeL%dNJ|@q1&qOLzrLXf)=4Q@H|2n8n~LWT zO2(h#pUhCn;g@M8k}2l1^Hvwp(ICz%SQyrLWX)BBzYK=z{;`KFM;rZj24*BUQ|sr` zg6PuNNij(7#S6(V&&_Sf&-Pkw;5aV#RzT;$iSOUk^i{?~_l9k-ymN;r|FlDRw?JyrR<9< z4r-^~z@?a563!_jfe-!PH>hG7oGhn(g%*L_B_FOAs3)TJ57J_UC0#aC?8Poo1k3R< z8?4Dz=*Rrrx2rqq4!`nn)k(`MgBmpCdiz0(30)qEL~#ab$(SYc97w~D>DM&Ei#)@@ zMeQBZ7W_qbY~5T@EDds%wuG(*At5G7%-fAdz^$U$wkGY=NX;lyxxP6*R*sypvU**~ ziCl6&YBJ-FBWU^Y2Gm%=C}44p>hfE)W}8CtNkAX(P4^4T<39G8S#Q*8n zhOyiIdyp&5FP+!<$amA=67;;g6oHKg1mB_l#Io*MisH$w#PC(kFXI!9j5QA3yx6fw z+^}di!G6-a|3&S@rRyVAsEjq>(29J#?DeNm8o0V$(No)r8P-v9ZBOxcq)$G<7w217d=XqCe@K-qk{GS!62f4ZW+}k5gg}>yw4_-3lQXV)rXRB~rLRe7Nnp``*MLubLyN zq8&D(8~*FhO+cHH9xj{7DiD`w)Y!NeV|=3z4I z>8YT>{@0*`x6Q6^{)z;EFKedP+;lJ>h2eTgYiR%HBJh?0Ur4=&$@}0K#G}2(o*JvT zl(M;+HH96Q3_1Kc&?LS`zBuDnEjO(`YYgFIeK7ROk-%tTWwo2?yXeiN6M1C(^tiHW z79*_sbbea;gN2%4F;ma8ZkN@}27qf+AW<5hkYbF2O*R-&VuXMy*AA+aR>Nn%mA=hL z^<7zY*UJcr+?s^dr``{XXv!a5zkC7_;_l+R~W0jOW4z+;^(I6 zN!1IYuUXXFB1S`grOo_nboYFoO=D$4VsM-~^=bvj2w#hFjwJV%PC$e#eS`kRhps0J z^2bqKFAbl$D`EVgc_Pbglrjfl#P+4+z_V{tj@HFeI0_m3~ z9T8}!3Gi5LaN336Ny$-Ia&jpm2tC@>hj!~7BsKr7%k^Xp-krE&a$61%o~(HA4jq2+ z#>t3rCi3}6P?Oc!=NC1P?epTKuPchLL9i2A!|lf{Vyhj%V2R%E+j%PNUa3R1blOU# zrI%PTH!@?6+huO55$0@#_Ws2O0-`AA{3Soc(Jw7}`1ngt8(y1`(HTUt^mlfH?ga;n$}?KGs?C#>#wS+-P;EA4U`#P<~4jQm3ujO ze9l|a1}h{0=cMQnK0=2ydi!wj6e=wY$&er}7S`=%%{+LSPF~Dz>duY=vU|^DdhvmU zA%h+N3Ohavi{j)uO+%bq~;6FFrL*Xk*imD z{4M0ov%kDkta=jksVrEg$3tO;)EXSQMj)m(ClD zB0CcWHsVreiF0HiH!ly;U{T>=UF@6sY;k0*DYsxe`YmrOSJT3{DKJ&&(BEm((M&&) z`~JZHI#vQExtXFF^S0JDhrXA?4L7GE-$liWU{8ON$#(O4L4F6>Z_a>DOn6w~?04_s z^#@0<2W0xY)%ik6hDg>|noNS9Q9#H9+sJ6avj3Kk)Ly@6WdEtTL!1Zv_X3ffhjg_tX$NZB$iQ}5nC~{!@JQ+*xduY%eP!6T?6R+rh_K>2LqMy z3u87k005iWidz=>?klmV6OC>EDTX}X4#tQ)UACM;CzBK(oAwK$^;w?JX+2<1v@vZ> zK1Z(bFiRXIwsSJ>CoC8#zm}=qx zYVui1&7A1Nk|fxFj7wMKE?UZ*uRkuO3-0h^c8^!h&QhXFvgYUE7AhwqMbVc&Yp+2-v%%$ngye{-ICZ^~xYraqD z`XPO>xHPkwC1O|O*nj_cQ-&C55>DlET22aP(uFFBn|m;Zn>@5|t@?s%o{E8}z1&%h zo78c%7?LkTQ*Lr)y2N!w=kqPAlD`i9Z+frUbvt=r&^^aoq|JiF6|dEjCee~|v%wk| zA2xo}ySFKJbk^fN?`AEWdhNoA61jL#Qx%WNH06YP1yZ|jhn4Wz$FECwxNVDV*$PLu zDPH__9iNNy<(v}!9JVRt%*hQ*Hl_rBk{yvgL+8_?z??LhaOJ{K!QMWfaO4!6(_GE3 z^L`)Jp4=-gcSlk%TQPgXd7Do1C6}UAmxD53YI4c=d}p>-sw`+UyT2i@wdX{Ysg{n|2Nw2TMk_GTs$`y_@SsJy%$O#YxX9LT3tg zo3RB}puyaLy``ZExtq2(WHL7A1D?@CCdbuXs3VS(f)iGCX(`bIBTl9s898=4RnyS( zGUzS|Y^wN>(dC#9>iRZ8Z+Ry_y8klXW~soJJAOQvM{1M(yP5$NF|pc>t{#Dk2Z0wM z1@o}6D|}#I{Zw%bM#ck}==?U9Bnpx?SGjKtvSK-fZ=4p@K(A6ggk6~Gj2_zzVHRTE z<7tJN>(?hww>Oo<)hA4N#`Zk4HqWn!bCn&oZ(zQ)9Q(xrI~UA<6dDv34-GD+I3z^< zrVlFt7s10!iH_eKsNp;n)}B_oNvazX4|Xkf+PC_Ezp44@5)^O`lwl=GjcOlkzRX5^ zMSf2yYRvYk@^N^x8{?^3{&PaM$LS%=>b(JQ3NvRzhAh`_ui|zXGIz_Z&lJf=KzEC! zx=&Pf4Hn#3g{;)E4nWjP4l#H zD!8?Kdxecm(ShXRL;mIcC}}xa=C#!6k{vO7jc`GlFdj7v$2e)Difo9g5PBC@0d-HI zRyuJc{sGDx%8;6l<}@V?-u?0Z{)@hB{&J4JNOUnJA8{R7MnFqWDL%FibZ|+@fvTG{ zn7g2U9MEU`wxOalHw5!E=1o{Pf!5tpU%P6#H?lI41|aI3Ggn+uO6<&$J7FBZk-@a= zNiQvruI^Lav@E${ktegsID=lgE7~HqJ082dcIB{a!XqGqg~arBSSRWI_fo|-ZZ>H; zCH%$x-7*M9-UhYB>vw;<&Q;V(JWtZ@wa1nByYpojW%cHNG&%jqYs%Lal&eI^N+s0P zGe{!q-UKAfn3~<059J5{21)5DYfo$(*5nk2eu`AGAmqP}XXzN!X`_K$iokrWTFg#* zsP}h!W$b&uWyPf#@Oy}wy1zVG+2nf2vzcX)jm8_;VK)3_YGZYNd!Ry1IE%kY_~jD| zv%aP3JNeweiR1dk_b#=TIG@nw~wKxWsRDD zUEgO-H~X`CaK3N_mQ3%oJ|cG>@36WXN*Nw2ZJ1lKPnRj>{I*Wg6Eqs&M>e?j9ewoA zJv_HGq`yE35~@2}$X0WMr(=_)Z%7#tw68(N!#?gyg?@dxHX zW(}!~f$FCs8rRT09N}rhx1S<9QI9AR-?TVFrBrj+i~9tLx{d6KjU_lf+9Ca|W%G;^ zth}zBj`B@08vB_1hWAsc(-NaW1KOp>h8LJ1*lQ^OU8oX6xnF!uH0ON#d>o6J_WcaN z=QbHGD>*Auh8x$f%CuQ;T`o+&S}>&*=!WBcj8qqllNv`9QCI$Z)A+wm{tdd~<5Hw( z!NgwNybI;1VpY~TerE)qP(aRl7z@_REcbxK`!i5>jHFW@D|^S$NhI2N z`AWHI+$}u3KY5H-$Ro&YGLp|-ZIFZQxaF*jg@_R*nL|vZl+@Ar*4;ZYq4by=F>KU# zW(A!xDeYI{QH2#TtNw3nXDak7Z`S1Jq5a9_K$Bfsmoe(I#^7ZtBVLf{Uom!ekb>07 zm$wg`FH<1z`#D>#->C!O)(KkJ{jJB!ISlOSLv~Pf#A!Gs`(8aZlZ<@WWPx9a^R3>2 zK2_0>$i72QwSH6|vc$kR?&!28$B zB~`m+;zUDsGm8k5bc|%x?+BilggKfSV`eXgZ;%3ET#uhE8lb>0ABv#;hzaFEr;VA9 z1tXM9bY9BMFJ8VV2ojHptzPm|puHs#If0cH^L&7WDzp?Ot~D{#%x^iG;JCZKzEm;c zAUF4*KuT^LiW^Fjy;~3HNgIgom7G%_XpUYnvbRNb_~pV9Q`b_SD*F-L@6JxtBJvx9{Om^^;NC1o(*%Uwfc?E3GoI>6H1PU~{9i^p9CH_#!^rL-&N1tNEa$khYY?qKnR z0eDL0M94|5|5a8pIW!&7soQBk-($rqyNp;l?<6ME&nyNWo48zZfaJX|Wx{jbUGYL* zfIQEK0IOm$m$M??b~CjtnlJCN(M-g}gIl6V>uZ`Qla(DL&f^42+!q*}Fs!fG`U&%~ z8YcH0c}G{iQABn`GSh{U>7ReIt1&;oh0g|#3&g!7-H{M$wCvm|eo|cKngrRqm5&79 z+a5pvXgaT=*ccf8Ht54hdMvAwCdh+QN=N|O)2*>_t#8b0rIty7fFV73lahtl`4@)e z^UK*+J+wHud6RKAo^unc%WnT}h00(lBWLd~?;>ABo`Ii_epLH5yZdx*N-f{LcHhG4 zYyoHcnC1&+NrDJ26DfyyrFaemM9%nFY(t<)=Lbi_&0mq#m5GDTntUP7i!GH$UzHxE zezIK$U>Gb+n0`K0Jo7PP z)Q^Y|LBfeSgu};>BBc3YZR8b`ENKs(%;d#o@`%!U?&N&#ff(tHuu*w1j`^-ikfF=MYKs7(q@lj_fi0xPGVQ(h-QnTkbztbwkB z2hY5_i~~iO$ZeW$z{S}L0IAtkw2v=nnci%xqZcJ!xzC3oz1h%;C6!XMQF1wVQD0w_uq7Y$Hqx_``;mX9v7A z4=>kf%h~`xVRAnfUZ+%Q%bl;3y9wes+9p;)chG3aTz)AKM=9C7Qg2X5Di#aAt9VVp zp=qOT7BfG%L)no1Fcv4tK%X(3Or5v2GiotQQla*UQ5BF(gVCgyH1ZsxcnF8}hca?} zO+}_GMc14?%SwQf&o7>Z&K5?mu6`44a@lwfz4?AFT9RKVw~a8kFP!_MS1P!kn~_^# zsgTrbxWay^DL=>luVk2_VU@eK%#vk+_24=;B{jc*>d)*r@gMrSV3%7>w^thBpQ~KA zAK2;Rr8}Q)c_oH8i6T=x&+D!NR|#??QWSaMS&dKXv*m9As#?kQQlT;8rj5*LGZo;O zHQ%Lcf)AR!B>n)ebwL~WU1}=U(?rlIq@_6??Od_=hdnN|ikGnT5$mSPHUDA{Cr8YZ<$M1ny zpf=CWGSl&xG0qZN z9#erwe0bw9KR#!XAF2{DTQQpKLg(2w*H(X5+DFhD9xAUgmS3-+Ue&I>AmV-an=;L2 zHnkkRb#8DrIV>uqL4hu>?)t1A*4=o~<|AllFuUr?$DP zf6$I#?ftgBxaWFJ_NTT=D-Hd8EH%G}hPjtYUB&`TcVgPt{0b@n#)E01(|#P(!a z+QEZHDV0yAUZ3lsu8nnxn;-D$XujSt*3d?*yZ6oBbM z>iE%PYkNiWv=lLS0-eLs(sS1jVT9>Psl*I;tbKjumBPMds<>k~)aR*}*C)D9J* zU7`_{i63LKOE#oy0znC>$t;^};DU;Rhg=~^o)x2H!!)Hj9ePIYz;OA20it|=(d@Hj z3`oMftkI^Nm;6BPE(`7v6Iu+54iL9C-lUCymv}TbJ2T_Ke)zjIF1lF^XRMyFe3Xdo^MY#|M}y?Sw%emDbf77|QqOZz{Ou)5vXzP)5%F8oLDP zK+M!Ly*#f;rXVJRGA+i}ECZgeeA<@S*S@~5LC;!gGO1+qI_@mZkFKb6 z_pOTu1|QU(zHyat1h4wTfCEn8ZIxkR9p0)lj1=MM>O{duX(Wt+Jigv}FYSSGBSUT6 zG!dJbWyICCQkXloQH7Je-;UIBQe|TxceEmSAbJ?n$S1w_hEE(4)uE*JwdBwzWc#9h z^3~Rqv6HSLej0j1vHxPSThUskVV-INGLHk#*BwfLW$|PBL4OJD_i}{NG6%Ias_8u%umbbT62|Zuacsi zEtYRsL>5HbU^jZ`am`cwJF6FtsdMAaK9eKQD(3?kZ0+ITTgS8ff|5BIBlkce1_*3j z9#Z9WxzjmaY%>V#RFdjSH$2=)EehOi+xW-zjH#c%yyduHC&rMrSPkG~vFFqUF4=HO z^=Z>KI^V&w_2G_PUCts}S3sg_IC;CKVmD>_&0k%?uU?I0W-I4|OT5D7Y8a}a3Tjzx zVG(;uy}`(?TZ`~_HhSmRru#v#LKU&gUi(gN=p}w~gB<{~c9?zO(-%l1=x*3mtj0x^ z>Jsz8aF`Dph?v|~2?m(MT}6ipTE4oTJOs@;G3xs?sM`uKgMp9dUY)MXuf_*Y?#;@c z=Q5cVJ>*UeK`tlDXg8#(9NgZWtdd6)i}=#?1i!22h#<(3AS{(kA!Rzw~eb&L(HAsjn{6lI(J?LUqwAlsK$OR2;v5%Jj9Euv& z&X9-uoAb6k(&`F7T!eyMt=#>E9sV4AO$?xB863&l6?FX?SeZ4j>1~5Sdf+~R4P40X z&@=iRxS9OGZB}EOSIG;e4B@vc%X@lS;yw1ycOx=F4(m7ZDM1Iaoi4W!&8)B#>YAPZUaM`-h9pRq6y;IX^tqO) z2sveT#BD^>OmyAMbduW)F=M6o0*-5y5@v9SYrj|ii+ek+tK`s}+A0&nfEvM}!Z{(9 z%^?}CxVdKX*a2lWdrpl+U9avt3MqU%-A_3h$OVhj!?FpD)>gp@fq8QHwe)QzhosTD zwHT}_Gt3H@9C4oAPm=@BU1dot*3?2iolkt?6AUg^{)0O-b=0^b)jy?nf&HO8=zksY z-2tf(WM%QNOP4P3xep3k0z~IK#`161s}|X4C^Pm&2sTh+l2;ts)3Ifba->dK-fSVJ zY$V(l*DaoJ%`c2YWFG&Jj_0PD9K_2SxzO3Sm|SJB=n02tF8>UX_X8(%)%i}j+iMh_ zob>{{f)_tUU^9k58JSCKeTmYcr&+`9;Q0|E@Wo4&g)Mh+N~3Z+xspLKA}^=PcJ6ZfH%J8czNmTGqnqgJSGveMa^I_{s+VO|`3#}~EcS$6#8@*hXFp*?<)WO7 zYExsACriG|yYC}>!Y>2gO>ya($eq%Kb@I>}Xf4(5H>xCOi8MEjH&X;BBz9q)O1sKb zSgPhuq{!g}ed?o^ArlFXnZs=8wsqRP?p%{Qm-w^tEj?DY5Qc~n!^A92T_XLSHb?Ci zeK8Q(LfpaDm6wrzoBN-OC=0Rwpjm>QBT^nNK39yv*%%|h-x8^BGqE!)s5zo zR)4imBJPN{WtW5W=xDIt$B7rR^Hm)qrJ%9Cebc=ekapGikS~e5#iExeauJ?w4U5}3 zuX-I7U%Syv1v5^nNb`=u20d!J8is0y>|^K`k_9 z)%mRkfwJ>*Q`rhUdm|gwR(<@!Fmdz2aQmbvK(MMb+P;*Gij1K7yvE3vEq;6>Y@37r zzzM(m>s`OGii3%2Atp;e$rpNUMojjwOCTo}Y;ibX(itJ&RX5VEk?2zusicabm|@|n zAy{v|q0LN@3(sK;!=s<0DOi@lvc=bnAKK?)C{5Tfqs}*tX?h4fC?V*5)AOe4B_mES zp!Ts|Eu+jecW&B~WvkCLWIF72yL}qd7w+d}8{^`7W}` zs;0Onqv^O4-S-s1h&*uwqwKv45tI4$je_Uu%p1vSM2Q_nrmy~PXXPSCU3UQ^jQrIm zNh|JXv}S%E%+va;8oUX74Srh}lQ4(;sO0-9aW(!me#D3(qYm zi8A(x=qh>#cKT@(_6 zg`UqD##>}3~59yV$0W~)||JqRg(uYE7C-P zikHn{xpZF5CL<#mk6JNJ>=>uBs&qKNq;oJZEe@$DE0w1g;89Q!ShF)+#W=UD)N-aN zme`Agxe~xOU?C$~cs^~wZxZrUiPB1-h#c+8HN~X;LlGD(SpSBKDE`1{4q-fKR_Nlp zqy?LH^@WYucJ8HiOR>@NzyT!V>F6R#qK|V-{z_tlB~}{?rE|ffnrF{mg^;sa)da)0 zuhm_!Eb*RFv$A*F)dyi3IB?$puW&lAB{&V_$M%|$Yoo>h?-Ru{8^M>o8S7zUmA(6} zQ3>cUa*(^h$JDpcwkvK{7KJHgoWJl4NBrGgpbJh>!Y+JlIk8YuLLQ~>E`PFR1X!4W z@*nGL*Ba`x9^OCf5#A~BI5&?mM`q3E&FXOclvj64#ucq8RV=Cl@=X=>nx`(DxbpXm zS~Zr{mr$M4ZyFJ|>0IR01zlC>jvG!%f((VAvUW2F4bYB_uJ*3bbmXOF z4EAf1oK9PTPMq2a3xpwU9Rw{0nTgKIjk*54y1kNyA6A67l*Zl?_qO@9!`;2P$7sNB zDXwiNDar{zsIR&yzok6}Fre$L7fn$LZbX{OMqb%2qgB!0US+0GpkQb(Dwvoo$bCVL z(b&4Mo2Dh=q9MkzsC+{*4GN5+{X{I|3ZW`zRE^8$(>sO{L}8%!kjBU?{mj8hDmd55 zU$HJ67})KNS&hZV@aQ9<7;(h*b7d?L5x!cZO-KS(2E^*HPyXcC3m4eau-#QjG+9ZY zJXE%XN!I2T$7Cd_(o|M_C8FKISw>F|8Oe=*k4YVCY5NKFH6ayyyn;9ZI>q}g>~D(6 z7DRHxSb{0;1VquK0%jyF4X!so=cUzXK(e9)21@eGAiAwQiHo%9>(!z|8F^(LMMeJt zc~yMC6+5|GOnhtVv!^VDvenjjUuKu01{JG%)Vw;))k%3r0yFq|=8*?S zuGbZlJ)h87cD0J8mA)&|uFg)&R#A^vDh(^dO}zmVyROh?5n&anm4n&-?rt`UQd3#G z7JLu^$qC8g2aGcI4{tq4ET?sr#3_t^&zb^Ry!fw_GS8K}xpZlwuZIX`gw8d`Pm9(O3m?jc4XE>B0T=abR?f z4&&7B-4zGl8P7C9S#N)KS8ljLZq@DGh&7Xlw(x$a|Il3N43;|P2)+xUnqYX^2@Nw+ z5akZv6j;(%ED16&0Qvhoz0`A4c>|P~XjX##{Mc%&U@xi9?_F)uF-RsN7IP{D92@(w$e8j~d#B$*Q~%n~Dl%`g#TD08oE|YPvC0`0f@TMKD`M?yUo$En$?U^6CENXetUVtAF4;aT>cLYY?OC?d2~)>k`58^iH3G&jXQ z<(^4Fr0LQb_!AOURS1Cme*KjjUr>`(&R^2mB3nqTOozu;Y2S1(diwOijdv@hz?*D@X0Q!sDVA$*SI;)EBftVm;5GFwt3!f z1jM!S%~L~!y3&OZu?Vb5temGru^g8mJ?~h`52@60s#F)LddjkpNb9eJw1-+8?$y8f=45;LMVMAENx|>$HTE$O^Rwt|`-zyNclL<#n%0ezJP{N>&BVqmnrYgJM zOJfn5;y74a`sK}y=voNpe%BK^tyA~Ilbx>cT_+w~iTN;j_~VYWcGb)uvqfZ!$e1iLZ@widPB$WDXNV32P`q0dF7qvj~mX~R$$jj7!Vroh&>9ghj3g% z&v5&racrf`#9b0ifQ;PAj@N4Nv@Ni~Zt+Bu;pvudP}>n!5@rG}CUN>UHg>lOZDg~c z^KQ?@h#?GD+%~H;s933fOx!(FRB>|UQY$ zRQ=QeN-(}njCvNWa=j<(JX2QXu<`)K8(1cG-oEd*#IBM6U_r5$vz2pgW|M91aI>S= zCJa*Qj=8%-RoU9R(`6xeKQ7iRXyN<2GZGCl6%yGY^S3ulz>qi+on3^#%JX^Q9vYF* zJ2NC^);)0x@!bz{6wd0kK;z9leJPeecd&dOQV1Y8tXgjz3wWF^e_O@eZ<-=f%`_aE zZ{E*G7Z%C5Gf~WZ{RaMGkmW^I0u_Bs#$g=sIJF@Z_%md}WyxP+W9^o!pSjtS;l=6p zczY%9;#xmjwy)N`qu<6kY+sX}F%!2Unb|6++e0~0vDADMuW%Pedn?LN?aq@DK7hwk zw+Ps3v`lX0Wi(K4kJD&qLyZypZMf3p6=7egzoR0_MQeG3$WzZX(Y}JTf{fNf&7J$omNFsP zrTwUA+EUk7k_E=={7J~CAImMLqF|!@)4-SH=08p*BeCU=hp(c(R1Tdj^x{`HJy`0D zw05JCP1`kSsgc%6jkayQ5}BUPEt@bC6u+V;S6>9j`n9f+|W%l?6aW&w#6q zjBw`KQm!kS=>=y*l^8NUvfh1%79&~ON4+oBYwf>?>!HW{rJKJV$mv>~Z*>ioXI5(N z2AXb(oNi&m&G)yJN?RY!0?#6LqaKBI@jY$1Ye6Dn3d8#o6DqGEEM25@I6c-I?ihQh zU&0tuv(}46+&etEKo;NUUAOw;T7gzR%YrY^e;cB``0(?yBhr6(O3}53Z=c`G-(O@2 z{ivYB+3#5N4}%kzd1FFwvh;uU=INZ*e6}NR&iNMD`{@(ri&cTXjFYQ)&Fz1O9H*NoUXgqfvES;={7(xN%pb8c*8SofNL@q!C(hpXe1p?_ z{=9fokHJefejmY8)=%QH>zbo`Sx!24@R&SEUog{&{M$_+nJ`A+_eE%B#drS9|-6CcAcL9#bg(FQ?xK+&YoG-!fs^cyRq{)64 z%4Fzrs?GGS`F&5QzV{;neYaYJ$LOp8ajwHCE_Ufe-M;h8YMV-)0K}{}8kDm*GdRkW zBUJy`nrO)9(SiK01$Cwb<~P3qRA<>=VTK&8=?e#SPZx;YR&l;g#^)2JQ;XSf_0lXN zzCtPV*yHe|?y&q3NbWZG^$j}Gsi&(+C{uI<_GRkaXWc>I z?|kY~=fDAaE^$+o{xn#+;ynjTt#d>D{oep{rX?h}B;AV_tEFSDiAWN9)y}WnVD$|K z%eE4>kk4sgPd~j_as2<+U`4wssiYY5)jXG5K-g7YhvPD6<^^qjnM+`Z>2f9QjiFTb zN78FTf!F%|RGA=xpUVX7^M41Ll`x#B)V}=x9ZYcHpPjxqN-r;$G5NsNnb+~_mEwRo zJMZOvYXGuQpMAaeKjsp>HK-j*UPiSAIG;DqQt zxuXqo8bXX8WUcTA6BF(7bS0sJ#me2j{3g9bXtWBY2UZB}51 z4nO}7a_ix^YC-HLY)pca1`~doHOI5 z{qL*FUUiQvrOIci5ICv2)7mPd3v4xgHVt-}D`-|5Sa%e>=nDky2hskOABkWAAfB-2 z+aVRxU`o~Ex127%U0g4zP!q#M$m%U09{CTOcY9>$DP9u7Z`#b#+T-~?DtkZ(m_VOG zF5o?u9C8a-FMsvQy8LFSm)yb1-d>|v4PG&`n2bz+2)X}Vh=`!7t`F*P8sW)|cvqq- z#L-^wgK%e@bgfN=Uwz{TMMhw&OPY=yC3P@ZU=`s-LAUMojg8=^ckYrFd#_Z-f8=#Vg?;Jt0{k;GWBz~XYdJYN1qHL3`SWup5!gL!$Y6x= z+fE>d2$ldvfOt-ZA9FbKukKxO@q(}W;|5*-bdKIp0j3@T(_(?7&q8$%0oWFWK0@}T z#mF#`W`YPjCS^Ky4t5+Xt9{Xrk)en$Y0X*5iFyZ_rCP_G*j@n5we zY^tjG-#8oq-JU>|>wa})49bxO4q8J_ZpyIhQ)UIN0*RoQIcz zkrDd1YUp!NTv$?C3LmI?!5tkP_<+IPC1s4D-k|DjLfD2-Qc;R+=gW6-&5BT!s{3`he{Hj<3nae*mYr(~TIt4J@Pldnpg#M@N zL!TeQwymzkzgCzwH13K6d;rqGGRKq)<;f zgfhQOl{NdFTJO5=j2d*&jW6)e7;q-aCjR;*S~%I#(o&G}?q7XJspev?R_4?$Npab% z>E-|04Cyvjr`wSi!r&B#TQDwA@ZJPm$vo-*rM|0Xr!GJLYfOF8DwKJ+Y)RxNHy0Ne z3?}_&75*-E)z(H9@BVwl)AV z4rH=M5iYKFc4m3Sg>)5t44HQxxrekDl~)40gWGQd;2CZs zmw#W0e9;UYV>t-JrWLv0;wYSyporggsm^SLRlGyI6n70TE<~zHKf3}iAiZLG@dkk? zN6yjgwMB%6-lFGGV?{P*6uHF?EBZQ&oq}S_BZlVryfm>;X*LUbWnsnn`tuuE*-aDE z|DfLpA2>h5JL12cRnTKf5023UDrf&5ew6f#rBgjYq&?g{_4hPesWyzZ?{Mg}}nhoRnwDFCXPDC>%DnlIA zm2t3*mKRt2w|~F<=={*^bDBynBau?F(V5&(%JwsFcJ*>@LVCLItwmTR@HCRoJ`fZ^ zL_~*!8ocfU1QM*T%h@md@qG5CNnc)GbYN&!bo$0IeO%i-_LtSVvw-A@zu=>@2Kdi< z0ETYZP6&XT7^L`fZzB(f5Fe&d zWE0J4hMO-LHDX-Gr>6eN@Dp)MN}bnZhyy9xd%66=(Bp+3vhBFxPl1mkK08^YD~DEm zDwUuX>0mW=sZb;*3P>xf+}|$puaxn8*((=YySv-l+fR?HryDUG930j*#Amg0*B;Bd z5O;Vg#+R5s=|3@RE1tRwm9=glw^MiWp-GKf1^1$yCXBQO z+CsayuRn(d2JeYhd|w+nc8;gt`pq)l(RmICDI%w#Z{x=}JjsDM)^B)3JWE35lJN(E zbakeg#pSe~`b=WV7^M@O_U~x(@*x*sO(@h0U|4Z1ScX3A6r%2rBpokK@5}8JqQybX zU~RCciKL=KHF19oG(DJO$m&B-R)! zjCXxnH(h;ry2N0Ldo0`xg8~)tk1IaUhMPKh54S6)1KKqdA(PjqFfScG_xX-2zpE3l zv+2t1T@3m20J}OG(%)NTq8zklgda7mSSSk4ay5S~IcER7Qy`b3+kWVztI=_2r>yDg zRsvrv42N~$6wb@+4onQ%Lk(LoTXxS!rzs=GCTEv2PNoirrRn4i?}5w0DK`(W%Bf(3 zY(u`>e7>xFGUj3Tq>Fd5TzUOnftJf{+<4KE>8T-g^M=TzV zfFdVZ$(}(wUrWk*CLk_J6%QJ3*ZquK>L#HemdNg2GvaC&~dFqoxEmUcAEnNlanEB;;6g&swzjW{H7=}=@?nnx{R+1 z6@wKXg^3iW*JE0Kw$U-PZbIOh&1QYtZO?MgX)f)la&54Abwlk8602rC8hO2|K2@Il zNwXlcu#C=Y3(cH|iv|qA=b&)1{`2uc`=&MSz`AdEykf6ciQ%tAI-JUxt2jD{%_$%z z;*G=9800!UT-fPCOqBLxq#p}~spKWO`+CC&hLW{gF+u=|kkjz!DSc$#c+kEIMccmG zi9ojV`mwQ}87R|JKZ#~HGBbg{g@HkriMbFWC$TlSr#Hf>s99JCHwvma6^!A$@22ay zY}mTuD!tbpM4?_BC@PwavBpC0{y*B@GOVrOYx_;9Qwqhk(Be*UhZfi1?(Xio+fv-! zp}4yhr+9D(7Tn!~>q-Cb^PKa_^?p2j3e3I|vS;?ptb5k)UhY6a#|~C9NU*>q%|b!r z0rQKn9MkyCrw^f{8E%UBkUV@vLt6`r=<|E10$|r!U1yb8Mk|LQuRt9e)0GkShAH1m zlzix~N%HhkcjO9wK-mvr$nTHqRQbV5HIH7oTVdde1$ewuzdO2>Talc1i=Jq1jcsQ$ z+eLilfl?%-YaK|gImd3FZ)x9J!A)KEd8k`n#=>J_Zkw{W*^9MnK2hyq;VKJFVJv$2 zTz~rC5Y58oyzT5KhY=}?6;V;338IAdYJTa@%JnZVT9`dv_^blvfK zm*?%hQ-#CCk^3HGeConjfWD zaY~sR7#;jm13uj+YTvo5OkiYqEuEt%;O+|8B);T-{6Tq;Z98;Wy)*SgK$IX|7+zOf zI4m)eH#k`BKi@o+hL~m6=4c9vRXmt2fJEr-Swn&|Bfq`k-sI>|%CjWN$)H9;J25?y z>wGBd}&W9j|F{}6j>>M z@?%e5plwsl%zAi8konQk_|ApST^sY2>-u4&SWddHu~=oT?bCI)Y&%oVj15fJ&H*RF zBbY2MVnJ=4DYD&uHraJwHfj?|jRZj4CGy%3>;P_`=M2;gvF>Z9iYWPiUZCT9)GdA_ zV~v6+6w!e9?dfq{8h1!zZb(U4Zz3OW$Gxf6`Zt8uTE=0E6D;P3x0eV!9(O5`LHlf> zfcLm=ERQAIswhB8wvG{kV&_9fGCM z$qQiNy~Rf2G6COYwX{C52q$(gF0B*Z=}~lAH#OV4g4t$Fj7^G+ z_AghmzY4SEMG-n}S(Kb`Kd9+>wi+%m}_&x@ser>Axq*LOWj z$P*KFPY)IGBhh6W}mcg8y z+U(i6pzf}+sqbYqYki-TUvjYy2nxV;^9F`w^{OceRoWgmMcEw@zH>qdrU5R9uJ>Q$ zJMFRyn&L!gwtDRg9`0nDyA3x%vpZ|>(6*r?R85ZronlKwW1EpN#-&`k||hhw;b-K&AYqf8pZP0NXEHr}n%yQj~ZH7iD+z zVPM$PDd#DnhMQX>JzYn&1RH_HpFT%Kp|brK^|$?4#BVn#MNLGVcrK6U?(gYr1J@7l zpkC%NXebKAzfd&O6$$`LVl9cQG`{y#@gSMv8l~jK#L)5=?g|S1K{!xVrcl<*wR2lw zk-tBW@$Rnm^&VZb9*@ee7E%`Mn=$;Mz(D)!G+9{&+pAgtA5rF!95Il;nY&m8P~a%w z2uL6&qIzGP-k~j=4-4vckgv?;a+{}@}szbryi~xkQ3Y4*&?79 zIKO$0;AGjpAtErLQ&L4aJz+d?=SSxP$igMe%ke!f z1fTHtV;ElCCiq}ITX+b#HMb&EkKT8AwXrh-v#L`D&RNHDc+#{6UWesxhbhA8!awsK zo(S)Q?mx)GV&2e_Dp2s5Rt$4k{f!+pot#7HDrr=?cP|j$W3%10)Qp(i7Z2$Lujxe= z#5T$MV>i&1k1G{yc;`QV-IT=G>VL6HJ`+{G?Hu_`aFL=a8?FT0lpByB(z#7da+vuP z2(Te}WCa?~`6*L-_t9lyJyJ)jJD-U^Rk4r*uD2=$%)x62&r18coGP*#^Fp8R7=4i& z=GK&%?K6&G!#~4d!!NtUI>MpTnE0vaWFfy}qo8986XSBmHeIVy2G6TD@0qiudgB!J9Y{^?mA#}xtpb<2GzN^ntG z9!ap{gnw6hnGFt_Kc-exw`xP(`P`>;w2mo?Uw*7Cf*jm_Ha2!gY@V>UZ-eoV5?-}3 zv2f5tSeq9@XEi2dxhDkzB8>^0hV%>MdUeQIXGU9^}*LMNi z-Pb5NO=YcJgJEHipwPs*xmzk{dBw)J3gj+{FpBtyWP)BCQ77vZXvB#G!s=m9!6RDR z_-Nd`C_36u;m@4$#fMl)XH*TZGw0^1Kyz;o1-`*qrzYF6t-NY;0YF;FK&*OrxXfkP zSyHTpe#8(sd_&L0fXIeAQeh`y_0)*j7{Y6->iWQ@bnLRDdFRnsRsAiGnMGit%wj(f z;h0e(M;$Io!Azz!7#fh<~IZAA2}j+zU^?rh-?E-!QH(9B= z^Nce@I@yXx!y;!T*nCNs7b~jtzkGS|odk(ieBhGcbs1{GO_(1oPFOvb?)GojF)21Q z<+i9$i)O70jzlyA#?)bc9zWBSuwfH+%iBXN)b(se)RU&txs1;ZxE|K3seym<<(g_o zIcA~2CXTU5u2icTk28mPGUyMo|4|Za%9j8FMrEw-3?H9asjQWkm+E3-W1c$T#Ke&8 z`hMq-8SVq*G;>2RRlrHxj}A;u4g#xju5pX1YzfrZJv~)`()yrYGOYhaeQWc3yWK(~ zN~N0#>fC*TZo=hION(b9HOf~^G23++^-a+L8Y>FV2F5dS6ZSPGcV@HSn{U~;TxYt6 zreXL|qx+)dL;~++6LGu52e)9IXH;&wOe_X9Q%POd&di0 z4`|uo@l*1<2$4{Pf5eAuhP=xbr^;nAydbh6#1XZpP~eWqjV}6`rmZV&UV<@QGFj^rLApp{wQ_IO`epE|KoPSE>VEc;nKvHj%(D#kDU!%!N@C62C(gc7 zC{P1ecs2!}6G^ujNZVhClgmkKO4vL?2H=}z)<6G*5&t*Klb$1WT1pDt!K+LRH=U#_ zCpJh)v%z9aEIx$nVv#58Gfs7@uucM;fS%8=CaFxdA+U2xv`=jTK74oaBXCl} zLoB7CU;v;CPncV0_|bzO)8gD#{?az@S%*sKe^Ik_3}g&%7-&VKNe!W%y+D2k!rz0N zMwN8J1*7ZIfA*E6NsbC_PQp9*m)ymz`0Rv;12do1F@!Po3pcxpW$A8B zr^^ON+eYa6Cn&P2B1Z!wGg^xX{5Q>Y{&!OeY-{Yo#h;2CXOq&MA2oD}*c{_yKnAq- z7dNb@@v($`|1QYEbUgs-0hG29TrJenSIuua^Ju%GEnFiMVqH8kQkDgqgUWRN1}FRr zRV)%n&R*}xHp}H?>^dt8GK)p`R7yC*M=0_LBIHfWj*F(c%z&2l7Hzw|ufM8c-N4Vo zikY{p`4fze%jPSCF*vp$?*H#lEB|=NaYm^AJWwk5P$RIQ1qwg^H0CVjo`RC zblbXI#S8c#)GG!95O?;Fcr*(f;~?f+&4X3>z>Ggq=r#-Do?dj_<2 z&s5v{QZ}BRRDDDFTrrqyd8V!dz4^FyjHreUp&p2m1N-!!U~quxOC+II?a73-Q+Nir#BWUT8ce(f?prxGb(2xm^A3BD@~TiO2~=-4Bv`E}R1Rgp{oT@--RP#VkgwXCZ69tZ5x#=Q^?% zDwZXjC#&?M(X(@It2G9X@u7|Y8&d>_z2p4bI=U0un}dXpIx5(&&33%7X4&MFE=22k zf0(||eLfSXkm?q$ku}3Tn^l{#u+zN8VbP?Oe(kV|(I!G(&gPUML}{o1u}%F}QEX#< zSTi~TaN5Vz6Fj9!Y=(F@igcW4o?@K4OkU!d?JOpvf1a#-8uJI+2avqP9hEacWjm~x z#%m!b7UWSNg0K}cUG8jhl*|uN*RJli-ebe~bgYKU1#+;N-4O@$wMm?_MxA=+q%3mf zLCP;tLEB@Z6nQTlE{}4s#o36P=qc=$?n%#pRioiYiLP~5cXyU&I^rS@SYT~(*pa}D zZWDd_9a_48Ul#smRdKQFuzEAvSBXy!o1xnU%yqJNR_w1{8=jG_8)Lj(oV7t~83~b& zW`BP>nm)qNCDWfO7-?5rHn(hYR%sGaoi^ckmK7rK#G>1fPK4i=wG)na%ARnFaDwLs znoH;9eRh6sV<%RVSXaq>6|0p<4l3VGZS5+7&cgiKgmr83`<6TOtWm9Mr)&gn{0Gdb zszeNvW%^YwhP|icmQ=}Xg>;jNT-b?Wf;+z*dRV{`dE!XF4ba|yhL7v_=24uShd1xt zA&n>L=1f`z?MhNm1Q#251)D~6%P}$lW(~f18w?}p@F@4iVj|;R0gD7`cNDg#CbkXL zbUydEQguq`T7iM}pY&Tj1;;jU)LN@uWQ@O{k`ZRJoPuNg27(`CPBH#<+YCs95lMWUx9*7;bB<*!{ zr7q8=tg!GI#gpeI@gUzZc2*k=JfWOW$$L$$FjiBO!)F=er2AL95OdO zNalMNBS^s-eC0?<4>tL?O7DQCnZNtt-5>Je5xYut@{+dZ;(UBTfWjg8YS8wq8b;5i z-k>F!5gVOGjZ@i*qv8f1R~_#8wVP`n%_qq4jZ!}=nk^t4KU0r!J<8;ro!Td_<8hlh z9u~bLxu_N1SuGWv8-uzWL{! zn3s8w0Lv$X_-+{n+F&w)JYAqwqYMj2*RDSo#oN8`{yIA>j_Y#B{aYft#Gs((` zP9Qr34tF=DOCC1%WWyGp=0tVj@%GX-fR05RBYJ^pf)>hv~r|(5){s$msDDu>qh?)W+zy5_9dM!!Y7x^C)AX=mE~?X zA#5k&1rKnza3ZwY7_wv^ORrCQ&7^;g>}%ZVW3qN7Hb1FFrvu5@!&$2&M8s<# zNbm-+e&F!_c}kj)iKnL?#Vv~Paqt}L8dZ;$E#qI18u`a*9!!T&c?X|Vvr;6_U=N5W z7f5NS!Aets>M8aTuc61Q`2Q7VMalgm;XLk7*EcBB&!m7S9((G%`%|&8uD;k$P(#aR z<5YuDR`ghN3g8P!LA5({K+=+7u7iNQ~xu= zHM8B{bKJKcTxwq^VdL}aAFu6WW`T+9g(2f-T}I;^lQV4Zd6Jb{2QMrS?mOk0#!HkC z1}e_FM3K2x6X0#o0XyB*%-cR^t77$on#Gjs-SI|lh%@o1r}b#?H@S^8lVlnUpH_s) z{8rxBE!b8GmOPGcf{z0A*f*148HB30UIfz0C?}KF&_gd>$`a@YX=1bT0i(O-mgt)s zZaz6GW;%+UIcf#`8~Ana9vM3U`Ov^f#x|cSGo=^UL|htgTD8n2#>a)w^G@EB#Q}sz zlper|ZCKwoTh4oTc*es{OUErs`r90(TPfADqa^AS-_JAS*Y>z8VYfGa3Tl&bbmk~w zDUY&=K4h>OzRivHv73+wz=-doU?<|9v@oLB+}`fBxS}glYUBQPH3vaawIg>G^2iv1 zD%81j&treC@|OJR(Fw9**6_!WuLeCw)q zeV<8ru_cDKas#D;-O`+JU{m_}ua+1OP3B)gBI3V%ufV7uW}ODZN#CI&%p^ET4* ztplTau>#md$>{k0;9gy+jFTa;tb&JyQO=0-{aow~5-nsTV&gMYa-UIb7$ak(snV(o z{Tt=e?wqg2Eb$DXlO+80%iS@fgEC6yVFh8^9D)`l(xm?zK^ozVht64MuNj{MC?q>= z8fHw$csr4qAT{Lw6~f7romRCfqkPRu;gnInh4zl&Oa8Ba`g{^7aeQ<2gEFh=1*wKLrw&#&x6GtU%k+-% zb0O7(XK-!tVxD~OL_cExg4rDvfLa7mG9p-ttg#G?mZCtst#8%PF1}pM97X;wkEyj?{!nmXCOC&>Ye=rhUhkTk-oK#9fRnI_p3xihKd?GB6OP5-yrF~npZBjt zIFlLZnz%oJcn}U2R|uB`m{lvaMC4(q_ZzN}B34VB<(q&3%6TC_KO^*Z^!aR_94in>Vnm zgmbMxzK#mSCBIx`9m2oC)iszBkRNeS`xFclDGqqkHZqw3YTkuXWO1?kn zy5BSSS1KoK#3(SmO5zv7{drD=dbL23vbUDbOx{F78f;7#ZrUW$ z>uRAXt6OY6Q9oC5#8uUooQ7SYo<-ded;2lR2(ynA+H*tUo!@5rWWjeMzV^zh$T`EI z%mk?1n)_Hwp@2wbtuR1y{63b=oS7GV?B`TTCjUi=^HGdkyn1dJ1Aj_=em19X+1$h^ zHkX<)W+^LWO((zaB~8opmm9GPq0bm;9<8>Ci37QqflO>h3)ddyi~9h{X(S8jcp*7~ zzmyolQ}yM^G41L5PFDB~lkx`#>_-j0$q^tIDmp&1kipVK5ZM+gM5V;4f6~b=S7dfoE#$O53{P1l`%R6jljcyE7}T;2NUBZdJ`53756YE zu%he7d;4wrK7@yGUYa|zle74JyX4U(vjL6Qz^oDrAeiQ}UrUDhIczwll2~c|!~j>z zgCEC#W^5hF@YBU!pb;nfI2)rp3epDiIY3T@F_Wq+wvX9+x=|GE$O#0dOy5qX&e+s= z_FK1bEOg&(o<$sx1k*rn`9G1I{;|~gskcFF(KB4X9kwY#G<5hm z0EP4%8{G7R`eaI?trp@tm>vIP+55AyOrbGFS%C)05~qSUX|nI<;4BhJDn=AE*WS+} z4GG3}jPXeYNUEZ<=C?#+fyAAI#5YfjD+R*JXR}iHGkX!j=)GoJgFU3+l@gP&D5iYJ zv|dJ5cIn=nCYXDmiya*^hv7i|T+uP_gUzzVJ>kdH1g(Tvn=iyxHIa5H?ik5lmBmzF z@F>ltMaAk7BRp!$vpQj;lak{A@)z|(24Z-_RafdGIiwglNoxuLHbRBW>1Y?O(^!&D zTwKfl77GYMnWvg%3}qFsA)KBUZ{uxc8zfCcZ&)1upy09JGjm^a>g;mFom*Z;AM`QQT~C*;5-iZwu_My`2EP#m8<8- z4!8dY!U2S-$|MaH9IX&CX{;Kpve-z`I;&LWGsniEuNTKvGeuBM#Myp!M-(7pjVh=B z$7_CX6ubTWG8?I?sQiYsiFCm|_S^QjWIteo{~pbs@eoSlU6I`K>0+yA9-Sr7AL#nn zjra9c>cMze#&`tr@D7WpSelxKhlEk3hdVxe5GdRsmA}>qd7-JdI5Q;{8yl~x>8y*! zr2DGC;*1Ti8Orf9+}CX(y8A1?RT#k=b%f#q_v9JsL%pMw z^zK(E1c>uBg^f4oRP10hLRlzcm_CgzwTd-FXSn@j!ul>$^#Ktglk!J?|vYaWwCrO4ncgDDKpH zx$+k-aIEG3UfoJ7#qwru4!V4((?YeZY?rC2Ft1ccPeFI?5Si$)G{W<2Va@V*X%HaC zm`-@e*p*&YxzS+69#yVmt7CydV9G*c_p-94s!demtBYHlU%?@ijv3oIjC7un_3xrr ztrFK1d*__@-q{RIqk=g&xUG(?tp}zjP057Cc(jE|O~YO|)1FXIZ@3}*?_7svBsU7i zoe}X&CN}!I(bl-;8j7wzaS~W)@&YmP4L@KhE^VJU-0_E0Q(Kc>)TlNOr$uff_bI9K zWr$6itL6-dRh)SmM8RZfH&c{6P0wm}!%D7X^yV{Y-wkSZ2h@`-hEK6|f7(}JtSbHz z`jdy+AB{6_6xpa|9+$VgQ6_`I7(~H0s!g69>dRR+pxUgd>A$^f#74lbH3du`;=T)} z^O2hgKKBh1RaB8>ATGAivb?IFQnRV7v-Tz(I5<2%s>0^{)Fd(=Qg4zij9G)wa0>3< zyY!M-$E%y^JtU8>{rxIrZdsL?cIB>Dk`MS4I=VH%`p@gZhq_)BGkms9SmC(`43C-5axN>YPPOUAL4~7kzJDvM6l)As-~PuH-*k89e^WXIDAS(UP`UHB;uLXvD;=)DX;e{m^-Wr zHmQjSdoQQc3HDN_(dVPa8&d!#VINXg3FM3&9 ziP7f2uo90kQ*WL*zOwbau0MTg;Bt6;c~n$9w|;n7H5kiU&4HV&x_2)t_Wb%5M=;Y9 zFK@xdPtBtS=skWF??h^6y9LeEO^6^qxH-em@hur(3wSIlwt{1JVfridYR9t?Bs_3A+|h5Wl${mUj;=gk7Cm;lIlW;rVlga^ zr!JiDj=*~1JpBC4mK;+d!MsjnxJ;2RYRn?iZR0n?(y|<;I-!=qMMXon5x&iJ?)6(a z(hcW1K2&W^NoH8w@fmHtygie*;EQqGHwadYYINy@XLGe^x<6>vp>r~f*)18x)r(q%_Ls9rQ)dl4dJz; z@lAQ@&84(Bu}lNe{mLSEE?rr*(<5m!HnkB*KvK}#-c@=X#`p~Tf+{dD8y5dJ<`xWO z%6g$SFuJC*{GCsPFTRc>=J%;}Pp{!sE5|MVHn=o(>+M<3MF;f2%iQ<3$lOK{*`f!V z46CtcL|WbCtK(B z&AMy&vjtLDSFhwChL4)nXB_sLmM0alo0zEc0*2pGMnXcaS6DCV#^)w6h zW@?HvDlT$0?m+O1j- z&o_|ZTzVoNqO#t^YG}oW*iVxzyoZ;Ea&l>0f0g;97dxtEhBI}WnVT^&7hPSgP8yB1 zf99H9PQ$(u>?*-@8XY%R{sJ?c>ML-JpcQyHwol)Pd;X}d*RM#Q)mwqfEIQ$eOA|)b zS+);0qeq0q1|H4oHs=xQr|f!|tatWDqK-xBiv$Ryu3UYOhtMWiUs)&+#Z~^LZswmM zb>8=Ab%dKj?Cd`Km$RWd?<~z45a47cVaxW|3~D2*k{hGQml=@jByc1>QhWXI4)Dx` zedcXuzit@>FW$O`Jo~QmEqLLUNzinKhM)g5l7zMLx&1UQBERD6%WsbV7)<$Zy3rd$ zion4ngv_PcE(!wK`he!$u`5r^0;-cyEHWIQyJu z2==R0!WUo5dFp60p4#)wuf#Cv+_ROldZ!zP@Vv1g{V`0gJ)U*ERcZ}w{T;sZA) zLkft~T3bfY0-tx3{{q^AzZR~EuExlBmzfK&OfA}ijx#iczK-#h7)mdEw1 zAVZO?rS(PG_bnNoe5yfe)-LnoOkVKdGT_Uij`S2EBpQW{&=lzSxrr` z!;g|BrS#5?#ZX+u>HLhP*w!<-z-+PYQQdf;(RWjbzGR+Hk85=#Oy{vgLeu21uI1+k zBv4*)u7NB+`^U7A9mEC-RV?{-CJl!&5p_8;B(DbMOwM(#UR2hgg`Zl`lLuaE6<{yf z@nnnzo4xxM>BzhMd0>`2{d@l~V_GMF!Ic&MQ33hA^HExgLrEmrCAK=lid zFe0(KGE1&BqiJMZW?IsL-(FulS^y0y1vRS*j3#-co+_n!x=vqTvqpyeO%Pp&XW?Zh8I{LR;vVzddDLegdDC5l9?nb-_Z` zC@E-faH=So*1eXz9b%JqQ_)D4(S!hHnv3-Ad@XD)PL8|V!?VS8Gb&D@DwW>l?xCB- z)~+)@?7S~JCh8qyIg~s-t#jM%#&FvlL*mJP@ZuizVZ8#mW(}Rsn#uaKu^xY2^|SN(1|aYs20TXNsgLEdozIXVdpGQJdxot;j(SLl^=>Lt}GjYvdl%Oo?%}#MOU9& z(B%f;v<<4VI}>x+7dFs1`dAY0;)CL{V*=PU?yUG9!VT+YXP4JGMg_p;Vaelp*D^8# zTcs|(4U2fH`qj}ze_-oYb%Ztzs=?Vd4pe8!yZa3SgLk)b^>~qGjesqEOz~MQ-t!L$ zbFB<6D!rafSm|Kc{2k#tt=u3l*zew+t}BN<>R__6t(YaD&Uw4 z+C+5|?}gM$&MBN~)=+gSRp_>EEGEq!Tg;HNeSLA+JQGe+!=!%+W?4zSaaHqPaTue4 zsuYAvCY|Q^5hhzdoAgKr{I~U?rWJKEAqBm*I+5mK#Eo7VhXTImLk>Sw zOlVHs4-};|t0-#9>h8vT)jng!7BK0A4zZT1&#YaE5QB&HQRzU|-Q;iThQQ4}cTh|! zu(bsc-LEaRAv-gI$_rR1A@(kBSqc>P;UezU9&{R8v9Bmdk$u$`daKR+Q5O%SN?lf-{m zecCrMtp90NOxU0&j^s@TzXJW{qwbVXgSq3sAO%sEC?btt#!+w+l91Tg*&+ILAg89r z$@%=Tckt7PXJ0kqF@ov~=pnEjYC}>`9J*-I_;_@9;X_H_occMa5*k4wcyv+!xQ4sUsf&WRI|BvXUu*d( zzZIGceBZu_6l`<8J?BLMbwo7TuXYAw2C~b}J4^oiPh%&Zk8{NBD-wicdmnoNPlE{H z@)!^FJsmC%oQt>LH9t88KSTfbjt0^{%n657=|!MPWRJXvEzFy0R*Y*d*b(Wwc7QYT++zMXnlP> zSmft35cLn}?g8RwXQy%=IJB`TYk#_X+P`cnej@^^wBf}Ll2W_eDBU@1SVk0jK0G=? zT8th6sNw(Geg8-A z0{?6G{vYlCe>AHnIaYE#JW%~QxoHLrJYcOHW;45}mm@0@>g=|eyYMgLt2Jb&^!&YZ zymwyw(apGB)wT{qL_5W(sJbD={uk<5RmaXow*&g0vYf(o9-eFOblSUv3j(jVGTI&v zHvFT5N}23HGqb$*UkL>{Q~I$v4eab$17xSyCp< zjWS{boB0MK`n}zE7Tj4H4jx-*MTLIwW{I5ca?FMH*qqq-1V(b@W~KHNFfOUh{w8j9 zbs|?@5FNSbU0uSFc09S2|EkeWfdaCAP50;W&W8c@hndUmWT5b0uT^8$)6Z8wP(6dT z@pPisa@N-|Ey}LHw?Emp7Yg73O&+`&ErE9X{NCL~a_^V#$;%lTJNT-@e@Y0UiE1{vFb3iJ~<>2h35?W@R~HLKem_Gz5XJDE6lUZ7uT?ms?ST4 zoAP&DZw20n(%>3dXE!7AuT*5sIBed6tkHe80?FL!bPr!CacMTFiFK8lBCgCr~lhGI`^P=E-FeMiSy_&7@n&VjepXLH`R`R|MEszQQI>?wW1BykFl|ELDtfu z^JR)EKfUz_jv_c3I2m+(z?M$R# z@9O7v%N59kKj+OI0?zcj(;hnE6gyyX1BSN0!-K)Oorqa$olmzy>8&nN28y&LSZRCW zG&uNce-Pohe2EgOHvaoQEQSK9tkdYfFSak5tU@wXb#l;5r;o}xdF;;}Tu&7ZO~dW8 z1|j_t)WgVzF3GpeRup}~SaQ=!@sPMo_tEk^qGV$X@1alS&7v2%ozhkL^2M}`)bczG9R z@H5x6o+WBcKr#9{t!+ejyt_IuPMs~ip*c75>b3gNQg_NSJ(jCby7YkbOOZMh?o^o3S zIh-wbP{-f}Mj*Q+I3j|Q@42p;zQ|msWmAmAfJY()fGsy_$DK94E!2fOIbGh{OD4|i zE*tTS>Xn}~l#9Nz?J@Q)At5YWw;hjWax-DEf}FDamm1d1%>28(fciI5#@Yh|b8!m? z@Y%9m6L|0BdECN|6EbU9Xd>BL747k%3r!@DR;Om^L9yiXL6Qko{y3#6zCkTm-V1TH zjP7_Gpdm+WGj;Y{LeomC>aBF^@d>Aof2x$XITxc{b6<1WN)6J~x^Pxw+mx?YRQ^ZPcd2O-mI?6?n5R;;I{ZvfN^-Uy*IV^SPB$W=hY+oysSCaS!;5#LBfPEI z#DsE$k}5m|<4u}G-txX2TTyBl2E&I|Tg7$Vzp|%T@(wnE6Fh57tr% z>uaBr1Lb*mg){)jc zDH{vAVB~@+zULs5-;&X_y88~(l~#OMU@LZ8vx}O*Ys8F|uoi5lv_<1435Hw(K8zeV z@lxDInlsA&0dH>d!mHE#3T|&heR^lm1n4YSmH99U9!3fl73$|UZC9=nmN1t+_si_k z59X=t-xJS-F>dW@1P+m|4h{8X2lyfHvL`V4>j!Jb>=3DpC=@|`jv-3 z;uw+HAo|r`eoCsa>P7PV*ikbAR-XEX)kUK->oUvQ#8U6((?WZ(8~V0`mZS@tM9(>R zlg{0T)CUyzEiS$Ue|aBV{j(3chndtErFf=7TPT5}aGRoaa9V|(4w>>YaB?S@?Ov%{ z?JzWmv^zRHzT*0IUF}prD1Vxipq6Ar zm|he;cQ65j8FVrc&%m7nD0=p(E$yk_ONZ(;3lM3UDTGiOp%)chSOm&vhRTF-c}9Np zs<}4fVezf|a+sOKH;8zL5m`aAL#%+Vpjy@6wEjqdaT&DWkGYu(=x1c!E#Ecd$>f_@bE{8u~Jfz~y zVzPMsd3Y{fRG?VA=JD=}bit}{;&61^BGBhfU*jocPiBG!+uuN7HrSeR>Y(-f6L;F(~Vc(LumCXiMO;6aV z5@?o^p`yg{aXjZ_szmJxQS=jdu)&&mL|h0UOhKn7C(WyphTn*TDs^sJ$}MhoEs(|4 z9yi0SF5hl~4nH=_+W5mL$tz{bI#-p%dP`QoyL z=P(3u7l^*CbkE&Figr8vPBGMO>h$hT+CNtw_*YT~cgZ z8&tfh@y?9h7tQV)r>{-zmnF%;8q-jikQ)>I&W(4(5yO%Vv(_+uhz&@dhoNAT=KDsS zb;cu$Z(pqKHeSuJCC5)lr;tD*6pvN>ifKcI-HxRu4A2eInfy_!PT!N~j4Yaq7a}9} zorUQ!is~f|L*i&fh>QR11=}kY`aunb>rFY3zOJcb{nsZW^$;tpaOy$}4`g3$=KiwA zKj_48o-%{HAn|WD27hNeJAdXEdGuP-{QB$PlCL09_o@5Y*IjC3`ofg9Ni?=jS>K#Z zn#}AmlPq9N6g}`Za*~F=TCU-u?NY;6axLHS)KrdqqI@YGqC<&n-e7{_(vP@Sd>i6zGF z-M=#>Q-ZpL$f`PJMVQvp<9X=&{;0#F;2?PZg>sqzYUQxU2cq{#b{Yv&Y-g6aIY(9c ztX|f@=HEVL_L?3md#!U#zdK|Y1d0pYwfLR=v=@rrSJ;5x6({$6Y>mZ#wvG*!Z6Biq z7+^O=vMX!~7T{vA4J>~7{2UabtLa$JC8I%oLHHnLuf7W4#K{aA z;o3+rq5Q-l$$F+38eik6?QkFajr=)iD^GX3^g|mm8OXmTjRRGx7nW=aMY@n-UsndL zzd%|KV0H+vX3dGzlo$_VMRFvdoJQ(MNRpxR0(xxq+VC>ZQhTWKXO-CMf8&k-O0+|q zbf%hExyV%|_W6w&Gfs0z!mC5dTneAm_#V7ZlVvGixv(Mz-dZK4iIyteOL~S9>`q)4 z4tQ$mSHHwC2af!5>_-m5Z54bNejlFG%w*@T3YMbmpDzR;>tKaWL)pd_OBp?O4Q|@q z)UwGLB`2vWtA56vRGUt&E51Zv)WoTAjW)kWMMms^h4nnD7&n2{sW*=;Y$7E(a}(aU zW@s8_fz*+m=q~hKVQf2rN^!d9saiEcugRjyA;FApj4aIsdWe|A(Kp37-~+s+rLd-6 zM~+9BBbHCbqXoGEQM0K8J9wkEY$+)^5B8xEr2n4FixBaY|3{<%5HJ1@k?Frxhy!m& zQx@iGzKTsw-curw{yuemf3@;0+Q;G1(QWhy&~Fs#e{;VKeq5g8B{iP>zg<@)bg~r3 z8;{!OCJ>FpoS+jObigMIMf&j?aTNvkU1<9~6awi(tQz1{6w$|ffa$S)BJpVz?TL*@ z3^7foUtK$F1Pb0iC9_aVJ6@iO3pRS+IC|&P*9m}T>((506Wi}M{UZV0TUxWx$McCi z>0P#epOLF9^-pMObkcewp2wc$PL z0f#fdI%gYnc2ZGA1@UlMOH;CvWMtfqKHdC3m0f30Q(d>l*Md@&PH3-!Gy_NrBs5>t zARtY83kpgVPwXa)K7X`$1@t2 z!^A}5yf#GP8G|>;YCDRT5rlijf2_HRe^?)Bss4AXE{a43vXC0ca;X|Jagu-feq&(y z@0{QN2;hGp5&wlRsrmoJ|6jwIZoNj}kEYH@2ks$JsNPdA<~?k3Vn_rMdAY1~bwIND zjy5ghr$vA^`Jb0bvH6x{Fh;N|sn{&xAy<|qw6bijD3ooRV$^MWn(mKENG7sQd$nyg zFtKtDKXIO)w+Lyb+QT|S)?{RAr+kl8#|m~yK?oDC^h%s0kyGyL<@QuR@>NyjD99B$ z^PDk2{KVWX{9hIK&MU8Vu&$GZeh+yzr*PS(@Ww5D%XjMto4+xAb$M0366Ia%_cYh$ zEg8&p&v|xc+03zK)B#1B3BTO2KXnKV{N(%MZz8p!Hgu0p>s?Bx z9r5#{NsE`o9Eae_sq9ARt@B2Joe>9z8HBhs?{2LG9%17{akzi%cKD=f^W@=cPpjJL zHRsWMAs|{{#pS_Ws$2co-XBpFmPM0x`Gs$s#~a@ZUP)usZs6E})4xm7q;)Pv6x78; zhNR&2Cf@J|GLQ^lgLdz-URcOA53N6RqSw2zdmOPH8P@{*;X%E1G*W0t1%s|xmi@1wYXauG*U!;TnB21$59p(05y?E=1p8Jg&OYqWy0m^;1ON@1HB_d zNrigRJZsFwgq)>a!gOMnkk3Z=@t#?))Su~nGT-!LG z(nD1yE-oI-ioS!GyYv|Y3YE?RWw=?r?pQ1N?c*3Y%KWDU1%vxr+pe=M6rccmKS%Oy zv4-O_8?!H6pvGH6aJb*3B-`HQ#9WiI>%RX-mWFdZ>bjV#3$)9d0Cve@kJ`qaUQjJW z642@CZIt5k7%1YGCE(!VvR}21FKT`;dxDXnrP>EQ+e}N32@MlnX z-<_l;$cm(`pR|LE34j4|)Ur>F>!sxHMNzg0R&G7X&;LpCKOEK65b~@vV)d8Y>VUJg zv+t3wa(?&q)J7QSTiIElwHbuMqfim*;Tl=xQE3V8TwL1=P|6{hUf*-;2tK(}TkrnQQ+pL=zgc$nlM8h;k~ypWqNl=u9Q;>#i@H59RG~eG z^g?7ST?zp{UohNA+FSB@XcSLR%*}vJ6GLv0UymF#_cp|ho(GK#STC_WWM$zp^#Zdb zqpPQnxVM9vSzQPcoYOR7aZwZm+2e%NreomgqUoX=2i!;3RblC z_A2K;y-iB2*#MokVq}|49kcODUEmwh5}GXr{wx#R zd4JeAA?TSSwN-9vqycJ*CnnJs5@#Bl$XLA!j1hRn^gM59R{ozJ-N`z~x49{?zS6N5 zzbh6CBpap-UAJ9lhvm4}I7UTeQHu`0;E}BK9P}uG^@BZkO9nZi6^HoPDDh5nfhP1b z+;O-II$=$-^Vo||BhP;MV^L-FRpYF!EmX{2qQ5)ouwt}`rgP8|@;&D105bjD9JRah z^ei7Ft#XD3*(%7{IFerlat|q7@~dry9>6XZ9uhD~RPpv}xhK6Qw#^D@xr~Zr=i~tRgz!Sqaqn5C~g99@WJCj?nGT7GOWjM zbH3*eXS%GYM>HzAm!ijP+3sDYfBt-kr{4a_IbTfzC3mFaNX(u`GdY~z9UhkzkGA-h zW9Qe`o?l?T#(d`EV}9QFK~}_TdU;juUA4ELY-G7K?f$`r#RI8Z2=f9vxJFxt{AQ!( zOouZfcW&kjnMbt&WgBkX#K`cBK9iSMF_JGTNqd3sK43rVi2zW2YNR|-a|ZW?=Mf#o zO+e3jMrcsgc3(Q-*$f=|ciOA+f|%Q1G6xq*LyD|wMt zPX3r;{8ilXR9=#H+xmX&`Tl)D0VKH&HlE+mS1iR_8gps{N)%NsPjAz3vhN8CE0_Ej zLrYu*CFh+;uC-U~@)RlWo$@{1)0LeVuR1xO_`w}pe=MMz*$-#NxyB4>;RIGP%vtO+ z>K&rh=h0tP%G0H2DB5T!VhR}cGM0$PTSysJl|}0}*w%7Mp?YU)Ppm7EUJhl$oi3o$ zBRHi2?(8mrG6KilAu}ys9D8Kwm3wqwwDU(Kru6Q}8tWb_b*S;!`e3v_3Nv&NStK}y zlHK3gULUFqg%ixhM0KpQ?ECZk)=T;i^T?D1?n#PCmlKa}U`)!W>{l1%5=(35y7W8q z8(?n^}m2&^8M1U!U1Ex>stVf?p-|n~UH-dML4B;(vxj zeo2X)=cd1>a+6{V2Vz!h|6Gfac1?9I3toRo3O8Jchm$_r2_7^vgbx$#bSETASmP#z zaojvQBTG2Aj0@PcGkEG^G+b7YLKTP(DTh^?K*X3(dOv5oF)rtTc0=<$QWR8cn@H5k-J42c_g zTD*C1Bc^Cw!_bHujbP$Hm4}}H>%m}7GBWA_cdmxMJgU<%cR%RX;B`C7I+k+g7UN!n?>kh?3*IjE+q zdnwBWn%F!R=BxvDmJ#Btj8y?jsOYjYWqp}>LaT9=CY%xnib&WO^7DD}EfUx&jUzbC z7iqo1=7F?V@1lgWZ|h*tSzlU-ph=?#CyIe_FBc6}l$Z8ubUK*m(=DL)V5d;9Kpos!|Ph%vM5_6ngm-r>nCF>q(f`pnI6P_81#rKbXCd`8Gqpx$NfOPqQZW95?_ zdlW?72m%z6Hv^@BbC~Zz2S$z?#>}KRdFdTmQ(LRYCV+Y8Kv?;djXtq~V{Twdowu4KCW8!6mNd4fp;ciS>s?(na&w()_V z1Ea#R*GKTtPVr43dSu*i=pvse66$SzJ2vU!y+mI#kc$##;PxV~hot?*UzB`5KpXVu zH>g|i$7bQbLQ9ZD_~@O7IieTE`knxwiralT{hg*HCPbSyf$~6UdYu#%I`i>XbV*~+ zd1>WNsWII{XZf6b%U6uQ%;n`cwZqn8rFy@+E!B|RJl~h;_D`(h#9VF6JwEg<>`FJ^ za@2?y@pZKJcxhBFSlKr1-F$zNje{!ZUE)1jn*HGSc}%uIe#ufVaAimz{sMX~HiMb&ASE(C`?0h6eo7BGOP(!%Fj`9zCO0C;@||OgR`^ z%x!IrVP&K&>`K!zans_jNw-CyX-gv%TW1!%YLx?9bMlN+1Dt3Cvxsip5|=N~-V&wC z^{haJiw&cb}( z;R6i2x{+PIs1Q_Xv{XWiU|37k!hAN{x#cU7JJ#Yg;Z=NzwK6Og9h{L9rnDEL8%S$* z)_I8GNI8)Ww=r6`R~KgGtdo`~J9d2Q6y)l`ky0eE2U+?q(n=9W&rUE8lV?T}NN#;j z*CY69h;@yoCeS-&?7Ona%jooHyj$TkaG#6K>$=twp%yifw@DS9;~c-^lmR!h{?r~1 z``gLb!)-Fb&C+JODit#M?dLzrm9)&j^2LRU#9AIMO-r4GXf;+12CBr1(PO1waqk zQ^E~?DWOQU9vvN=!ADiHsiqfOhoIro8pVufAEZwjCFv#$>(z?KbGrtjckl!5%}dw? zAgFd=WIcNeV*-(gD=Twxae>@q>oU5TQ(Rshd3BDzIIGF`8b9HUh`lVA05m1Vz-zl1 zvg5<$HFLj0=Uo&TRhyj8#;fMS9|+>KhUZ)g&U~+4i%rZ(sL0duF}LAM#{xBZMkWlO z4>15FWyVD`6~zxmS)L^*+fu7Li^lGNoDWxp*lPj)LKXO9N6)CrYXCt>9Isja&T}PC z<&VFF#?GQ~@QoBGoC;wApC)7lZ)!vo^f#BeIbk8S~IP%XZYQ!^`&} zCM|(01{|C8tCWZ^I$o9aw}xhWy>q+b9X_}=fCkH$fke^R2Jjt-cs%#1t4TQ)8|CuN zIyepnz?S${3_o949<}wH=b_4P`R!x`@u{Gu2`)yWIWj=n(aX1)G-eFoTSI0J0jH1{EEn08+EA3|K)<>!D0zA3!>$hhDNmxwIWsjm52+aI-I(9#FH-*dQON}kO4E47f*0>I8eFM~7^qu2nO830s9tdC2^1pr)dqqw6okc^P=9p9R$ulu%$CM-`hAX+=hxnT6~<&NKb^ntD_ zLAxoMO?5Aq z3)#OmkK93L$w`TgK*X}a-w>tL?=$UxPn5uC3>rk8@5?eW*CpEvC9^b0%*o8GK_+c8 zwgyj*k7K{@C{u+~E%;vcrZt@j6=2&-Q&>WL{Dd+8pufgsmq|JgLG`tAx?gXn>7@8- zF#b(1KE1Id;|mgm-|R>XB##I$hJn%A9ZTKJb_q+u7_DbFV~-134PT0PS%yzmaceKS z`+Q5H;q=utJAPX)ZU2bnl>otet!lD0aoKH0fZJjMXAtjB=}+HtuD+=fu*rxb z!z7a!h$GiMjHu|zRm z|DJ57h~LLezy;%&I~<$hMX--2i#~#N(AK9L4K7as%ZyX-36Dg14t@R|qpeTja_uzh z#n{pkouXQ}i$z+$faQfgyqX&D)COZSW(~y5=tv=Zbe2!-2p%}+>8t9l` z1X8A{h5uSvUS^g4_^G~vJLB6glRX!KR48tNvmqhunH3W`*MZL1d^iABtPET@&wM)J zpk-!d`|I+ezNnFF{H4df`kOh%hmXWBIIO1jnTzS+_gFX>&o8z4@H)+^&}B5Y+3u{?dQgq9D7y z(gt|TmU&U)HufS@_xFpU$EfjE5M%+QZm?&jfr$l*<%Q<*52zbOkuY{G|i(sQbxuDQYJ<% zQEIvvqeV=1e+yW&Ao1o=BxZXQc{!o+3f}#w(1Qpk`$XVQDZE1>S~dUqci9}Do0wQN zU`SXuKR7tp@$i{{=LCM~|Jn5I{~~h-M@Ox#teA0OuCA^TsHtfW*5@cuvf9>cM~`M| zkDD=c=au9nUn{raV&dv>v)0VqtpqOOyV3}~0o}W0giGbpL9>;q%ldb=?GDf~1H0_aS$|*I& zxGi$ovK3EySKIq?hXtt$vSFu_T}06F>P7+m3O(nS4& zq?YH#=!)%WtOC5$c=v;6bmIt1ylq$NBT`ojA&S2|miAZN`5oGKeR!kakO{(keJ_6e z$berG1di<#j(;8{?*4GJYea#a7wd|BH`Y>9C#k8ayYq#a!jQ4bRX^2GWKgj8YclBEcCSd-E1P`bk{Ela(NMw0lQxlmE-a}R%qVn^~u>x>j z`LEc8pSLMV82wKQ&c9>z|7 window.__wootcVMCalls.map(call => call[0]))).toEqual(['prepare', 'stop', 'boot']); }); -test('VM-first action explains the next required account detail', async ({ page }) => { +test('VM-first action shows the next required account detail', async ({ page }) => { await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: true, probeStatus: 'passed' } }); const vmButton = page.locator('#vm-prepare-btn'); + const vmHint = page.locator('#vm-prepare-hint'); await expect(vmButton).toBeInViewport(); await expect(vmButton).toBeDisabled(); - await expect(vmButton).toHaveText('Enter a valid Linux username below'); + await expect(vmButton).toHaveText(/Start .* in a window/); + await expect(vmButton).toHaveAttribute('aria-describedby', 'vm-prepare-hint'); + await expect(vmHint).toHaveAttribute('role', 'status'); + await expect(vmHint).toHaveAttribute('aria-live', 'polite'); + await expect(vmHint).toHaveText('Enter a valid Linux username below'); await page.locator('.field:has-text("Linux Username") input').fill('alice'); - await expect(vmButton).toHaveText('Set your Linux password below'); + await expect(vmHint).toHaveText('Set your Linux password below'); await shot(page, '15-vm-first-launchpad'); const password = page.locator('input[type=password]'); await password.nth(0).fill('temporary-guidance-password'); - await expect(vmButton).toHaveText('Passwords do not match'); + await expect(vmHint).toHaveText('Passwords do not match'); await password.nth(1).fill('temporary-guidance-password'); await expect(vmButton).toBeEnabled(); await expect(vmButton).toHaveText(/Start .* in a window/); + await expect(vmHint).toBeEmpty(); }); From eefc4630167f5240ad726a8ac2c46e0097ff2329 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 19:18:42 +0000 Subject: [PATCH 18/33] Plan measured smaller VM capacities without changing defaults --- .../2026-09-26-vm-capacity-plan.md | 115 ++++++++++++++++++ 1 file changed, 115 insertions(+) create mode 100644 docs/experiments/2026-09-26-vm-capacity-plan.md diff --git a/docs/experiments/2026-09-26-vm-capacity-plan.md b/docs/experiments/2026-09-26-vm-capacity-plan.md new file mode 100644 index 00000000..652735b2 --- /dev/null +++ b/docs/experiments/2026-09-26-vm-capacity-plan.md @@ -0,0 +1,115 @@ +# Smaller VM capacity trial + +Status: proposed experiment. No production default changes. + +The current host profile creates two sparse 40 GiB files and needs 88 GiB +free on the Windows volume. This sum includes an 8 GiB Windows reserve. +The helper at `0cb8776` rejects either disk below 32 GiB. The signed account +bundle remains unchanged. A 32 GiB target plus 16 GiB scratch is not valid +under that helper contract. + +## Proposed contract + +The helper owner must approve the field names and version before the host +uses them. Use separate `minimumTargetDiskBytes` and +`minimumScratchDiskBytes` in the signed `builder-protocol.json`. The values +are lower bounds for the helper, not proof that every image fits. + +Keep the current 32 GiB bound for each disk in the first contract change. +A later experimental profile can reduce the scratch bound to 16 GiB after +its tests pass. A legacy contract with `minimumDiskBytes` keeps that value +for both disks. Do not interpret a missing field as zero. + +The host must verify the signed runtime before it reads this contract. +It must reject unknown versions, invalid bounds, zero or negative values, +numeric overflow, and unsupported disk sizes. Both separate fields must +exist together. If the legacy field also exists, it must be at least as +large as each separate bound. Thus legacy 32 with separate 32/16 is valid. + +A profile must bind its image digest and helper version to the evidence. +Do not apply a smaller image's capacity result to any other OCI reference. + +## Experiment order + +1. Wait for the active desktop test and Windows writer to finish. +2. Validate the new helper contract with separate bounds at 32/32 GiB. +3. Use new, dedicated 32/16 GiB disks for a named experimental profile. + Keep both serial checks, blank-disk checks and mount checks. Validate + both disks before the first format operation. +4. Pin the repaired image digest. Use account creation through the private + input channel. Retain the complete receipt and helper process exit. +5. Boot the same target with its persistent firmware variables. Sign in, + create a document, shut down cleanly, restart and read the document. +6. Repeat with the app on Windows. Do not infer Windows behavior or speed + from the KVM helper trial. + +Use a fixture with enough physical storage for the chosen upper bound. +A larger thin volume does not create physical capacity. The current Windows +clone has an 80 GiB logical volume and cannot pass the 88 GiB profile. +Its shared storage's reported 35 GiB free does not prove safe expansion. + +## Measurements + +Record a sample with its timestamp each second through the full trial: + +| Layer | Observable | +|---|---| +| Windows | Volume free bytes; allocated bytes of each sparse file; QEMU memory | +| Helper | Target and scratch capacity, used bytes and free bytes | +| Hypervisor | Actual allocated bytes and backing-volume free bytes | +| Desktop | Free bytes after login, document creation and clean restart | + +Record peak use and the final sizes of the files. Keep the same image digest, +helper hash, QEMU version, RAM, CPU settings and sample interval with the +results. A missing sample period is a limit on the result. + +The candidate admission bound is 32 + 16 + 8 = 56 GiB, after runtime setup. +This is an experimental bound, not a proven product minimum. Account for +host logs and temporary files as well. Measure physical use before any +future policy relies on sparse allocation instead of full virtual capacity. + +## Host changes after approval + +`app/vm_image_windows.go` needs separate target and scratch capacities. +Its free-space check must use checked addition of both capacities and the +Windows reserve. Its file creation must retain exclusive creation, sparse +file setup, exact logical lengths, sync, and close checks. + +`app/vm_windows.go` must select the verified image profile before it creates +files. Store the chosen profile and capacities with the installation record. +A restart must preserve the existing disk size and GPT identity. It must +never resize an existing disk to match a new default. + +`app/vm_space.go` samples the free space in Windows during preparation. Keep its +cancellation cause and wait for the helper process to exit before the host releases the writer +lock. A sample every second cannot promise that another +Windows app never consumes the reserve between samples. + +The host retains scratch after success. Reclaim it only after the helper +has exited, its job has closed, and the verified receipt is durable. Delete +only the known scratch path under the protected tree and image lock. Never +delete the target or firmware variables. Preserve failed-run scratch until +a policy for recovery exists. + +## Targeted acceptance tests + +| Case | Required observable | +|---|---| +| Legacy 32 GiB metadata | Both minimums remain 32 GiB; 16 GiB scratch rejected | +| Separate 32/32 GiB metadata | Same admission and disk behavior as legacy | +| Missing or invalid bounds | Rejection before any disk write | +| Candidate 32/16 profile | Accepted only for the measured immutable image | +| Exact admission boundary | 56 GiB accepted; one byte less rejected | +| Sum overflow | Rejection before file creation | +| Wrong scratch serial or existing signature | No format operation on either disk | +| Scratch one byte below its minimum | No format operation on either disk | +| Existing target | Contents and length unchanged after refusal | +| Real low-space transition during helper writes | Child exits; lock retained until reaped; no success receipt accepted | +| Clean helper completion | Durable target identity precedes scratch removal | +| Failed helper or malformed receipt | Target preserved; no ready or desktop-ready status | +| Restart after a new default | Same target, firmware, account and saved document | + +Mutation checks must remove a bounds check, swap the two bounds, release the +lock early, or accept a success marker without its receipt. Each mutation +must fail its corresponding test. Filesystem creation alone is not evidence +of a completed install or a usable desktop. From ffbabd3c3a11dfad3cb99c15159a3a699e306b78 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 19:25:19 +0000 Subject: [PATCH 19/33] Parse separate helper disk minimums without lowering the VM profile --- app/vm_image_windows.go | 35 ++++++- app/vm_storage_profile.go | 106 ++++++++++++++++++++ app/vm_storage_profile_test.go | 171 +++++++++++++++++++++++++++++++++ app/vm_windows.go | 5 + 4 files changed, 312 insertions(+), 5 deletions(-) create mode 100644 app/vm_storage_profile.go create mode 100644 app/vm_storage_profile_test.go diff --git a/app/vm_image_windows.go b/app/vm_image_windows.go index b7949c8f..ba16be6b 100644 --- a/app/vm_image_windows.go +++ b/app/vm_image_windows.go @@ -3,22 +3,47 @@ package main import ( - "fmt" "golang.org/x/sys/windows" "os" "path/filepath" ) +func currentVMStoragePlan() (vmStoragePlan, vmStorageMinimums, error) { + plan := defaultVMStoragePlan() + metadata, err := readLocalMetadata(filepath.Join(qemuDir(), "builder-protocol.json"), 64<<10) + if err != nil { + return plan, vmStorageMinimums{}, err + } + minimums, err := parseVMStorageMinimums(metadata) + if err != nil { + return plan, minimums, err + } + _, err = plan.requiredFree(minimums) + return plan, minimums, err +} + func createVMImageFiles() error { + // The caller verified the complete signed runtime before it acquired the + // image lease. Metadata cannot lower the image profile by itself. + plan, minimums, err := currentVMStoragePlan() + if err != nil { + return err + } available, err := vmFreeBytes(wootcDir()) if err != nil { return err } - const capacity = uint64(40) << 30 - if available < 2*capacity+vmWindowsReserveBytes { - return fmt.Errorf("VM preparation needs at least 88 GB free for the Linux disk, scratch space and an 8 GB Windows reserve") + if err := plan.admit(minimums, available); err != nil { + return err } - for _, path := range []string{managedVMRootDisk(), filepath.Join(previewDir(), "scratch.disk")} { + for _, disk := range []struct { + path string + capacity uint64 + }{ + {managedVMRootDisk(), plan.Target}, + {filepath.Join(previewDir(), "scratch.disk"), plan.Scratch}, + } { + path, capacity := disk.path, disk.capacity file, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0600) if err != nil { return err diff --git a/app/vm_storage_profile.go b/app/vm_storage_profile.go new file mode 100644 index 00000000..b5a38b54 --- /dev/null +++ b/app/vm_storage_profile.go @@ -0,0 +1,106 @@ +package main + +import ( + "bytes" + "encoding/json" + "fmt" + "math" + "strings" +) + +// Minimums describe the helper, not the capacity needs of every OCI image. +// They never select a smaller host profile without separate image evidence. +type vmStorageMinimums struct{ Target, Scratch uint64 } +type vmStoragePlan struct{ Target, Scratch, Reserve uint64 } + +func defaultVMStoragePlan() vmStoragePlan { + return vmStoragePlan{Target: 40 << 30, Scratch: 40 << 30, Reserve: vmWindowsReserveBytes} +} + +func parseVMStorageMinimums(data []byte) (vmStorageMinimums, error) { + if len(data) > 64<<10 { + return vmStorageMinimums{}, fmt.Errorf("helper protocol metadata exceeds size limit") + } + // Reject duplicate keys instead of allowing the JSON decoder's last-wins rule. + decoder := json.NewDecoder(bytes.NewReader(data)) + token, err := decoder.Token() + if err != nil || token != json.Delim('{') { + return vmStorageMinimums{}, fmt.Errorf("invalid helper protocol object") + } + seen := map[string]bool{} + for decoder.More() { + token, err := decoder.Token() + if err != nil { + return vmStorageMinimums{}, err + } + key, ok := token.(string) + key = strings.ToLower(key) + if !ok || seen[key] { + return vmStorageMinimums{}, fmt.Errorf("duplicate or invalid helper protocol field") + } + seen[key] = true + var value json.RawMessage + if err := decoder.Decode(&value); err != nil { + return vmStorageMinimums{}, err + } + } + var protocol struct { + SchemaVersion int `json:"schemaVersion"` + Protocol string `json:"protocol"` + ProtocolVersion int `json:"protocolVersion"` + TargetSerial string `json:"targetSerial"` + ScratchSerial string `json:"scratchSerial"` + Legacy *uint64 `json:"minimumDiskBytes"` + Target *uint64 `json:"minimumTargetDiskBytes"` + Scratch *uint64 `json:"minimumScratchDiskBytes"` + } + if err := json.Unmarshal(data, &protocol); err != nil { + return vmStorageMinimums{}, fmt.Errorf("invalid helper storage contract: %w", err) + } + if protocol.SchemaVersion != 1 || protocol.Protocol != "wootc-helper" || protocol.ProtocolVersion != 1 || protocol.TargetSerial != "wootc-root" || protocol.ScratchSerial != "wootc-scratch" { + return vmStorageMinimums{}, fmt.Errorf("unsupported helper storage contract") + } + if (seen["minimumdiskbytes"] && protocol.Legacy == nil) || (seen["minimumtargetdiskbytes"] && protocol.Target == nil) || (seen["minimumscratchdiskbytes"] && protocol.Scratch == nil) { + return vmStorageMinimums{}, fmt.Errorf("helper disk minimums cannot be null") + } + if (protocol.Target == nil) != (protocol.Scratch == nil) { + return vmStorageMinimums{}, fmt.Errorf("helper disk minimums must occur as a pair") + } + if protocol.Legacy != nil && *protocol.Legacy == 0 { + return vmStorageMinimums{}, fmt.Errorf("helper disk minimum must be positive") + } + if protocol.Target == nil { + if protocol.Legacy == nil { + return vmStorageMinimums{}, fmt.Errorf("helper disk minimums are missing") + } + return vmStorageMinimums{*protocol.Legacy, *protocol.Legacy}, nil + } + if *protocol.Target == 0 || *protocol.Scratch == 0 { + return vmStorageMinimums{}, fmt.Errorf("helper disk minimums must be positive") + } + if protocol.Legacy != nil && (*protocol.Legacy < *protocol.Target || *protocol.Legacy < *protocol.Scratch) { + return vmStorageMinimums{}, fmt.Errorf("legacy helper minimum is not a conservative fallback") + } + return vmStorageMinimums{*protocol.Target, *protocol.Scratch}, nil +} + +func (plan vmStoragePlan) requiredFree(minimums vmStorageMinimums) (uint64, error) { + if minimums.Target == 0 || minimums.Scratch == 0 || plan.Target < minimums.Target || plan.Scratch < minimums.Scratch || plan.Reserve < vmWindowsReserveBytes { + return 0, fmt.Errorf("selected VM capacity profile does not meet the helper minimums and Windows reserve") + } + if plan.Target > math.MaxInt64 || plan.Scratch > math.MaxInt64 || plan.Target > math.MaxUint64-plan.Scratch || plan.Target+plan.Scratch > math.MaxUint64-plan.Reserve { + return 0, fmt.Errorf("VM capacity profile exceeds supported disk sizes") + } + return plan.Target + plan.Scratch + plan.Reserve, nil +} + +func (plan vmStoragePlan) admit(minimums vmStorageMinimums, available uint64) error { + required, err := plan.requiredFree(minimums) + if err != nil { + return err + } + if available < required { + return fmt.Errorf("VM preparation needs %.1f GiB free for its disks and Windows reserve; %.1f GiB is available", float64(required)/(1<<30), float64(available)/(1<<30)) + } + return nil +} diff --git a/app/vm_storage_profile_test.go b/app/vm_storage_profile_test.go new file mode 100644 index 00000000..f56b7e2f --- /dev/null +++ b/app/vm_storage_profile_test.go @@ -0,0 +1,171 @@ +package main + +import ( + "context" + "fmt" + "math" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func storageContract(fields string) []byte { + return []byte(`{"schemaVersion":1,"protocol":"wootc-helper","protocolVersion":1,"targetSerial":"wootc-root","scratchSerial":"wootc-scratch",` + fields + `}`) +} + +func TestVMStorageMinimumsCompatibility(t *testing.T) { + for _, tc := range []struct { + name, fields string + target, scratch uint64 + }{ + {"legacy", `"minimumDiskBytes":34359738368`, 32 << 30, 32 << 30}, + {"pair", `"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":17179869184`, 32 << 30, 16 << 30}, + {"pair-with-conservative-legacy", `"minimumDiskBytes":34359738368,"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":17179869184`, 32 << 30, 16 << 30}, + } { + t.Run(tc.name, func(t *testing.T) { + mins, err := parseVMStorageMinimums(storageContract(tc.fields)) + if err != nil { + t.Fatal(err) + } + if mins.Target != tc.target || mins.Scratch != tc.scratch { + t.Fatalf("swapped or lost bounds: %+v", mins) + } + required, err := defaultVMStoragePlan().requiredFree(mins) + if err != nil || required != 88<<30 { + t.Fatalf("helper minimum silently changed unproven host profile: %d %v", required, err) + } + }) + } +} +func TestVMStorageMinimumsRejectMalformedContracts(t *testing.T) { + for _, fields := range []string{ + `"other":1`, `"minimumDiskBytes":0`, `"minimumDiskBytes":null`, `"minimumDiskBytes":34359738368,"minimumTargetDiskBytes":null,"minimumScratchDiskBytes":null`, + `"minimumTargetDiskBytes":34359738368`, `"minimumScratchDiskBytes":17179869184`, + `"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":0`, + `"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":null`, + `"minimumDiskBytes":17179869184,"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":17179869184`, + `"minimumDiskBytes":-1`, `"minimumDiskBytes":1.5`, `"minimumDiskBytes":18446744073709551616`, + `"minimumDiskBytes":"34359738368"`, `"minimumDiskBytes":1,"minimumDiskBytes":34359738368`, `"minimumDiskBytes":1,"MINIMUMDISKBYTES":34359738368`, + `"protocolVersion":2,"minimumDiskBytes":34359738368`, + } { + t.Run(fields, func(t *testing.T) { + if _, err := parseVMStorageMinimums(storageContract(fields)); err == nil { + t.Fatal("accepted invalid metadata") + } + }) + } + for _, data := range [][]byte{[]byte(`[]`), []byte(`null`), []byte(`{`), append(storageContract(`"minimumDiskBytes":34359738368`), []byte(` {}`)...), []byte(strings.Repeat(" ", 65537)), []byte(strings.Replace(string(storageContract(`"minimumDiskBytes":34359738368`)), `"protocolVersion":1`, `"protocolVersion":2`, 1))} { + if _, err := parseVMStorageMinimums(data); err == nil { + t.Fatal("accepted unsupported protocol") + } + } +} +func TestVMStorageAdmissionBoundaries(t *testing.T) { + candidate := vmStoragePlan{Target: 32 << 30, Scratch: 16 << 30, Reserve: 8 << 30} + mins := vmStorageMinimums{Target: 32 << 30, Scratch: 16 << 30} + for _, plan := range []vmStoragePlan{defaultVMStoragePlan(), candidate} { + required, err := plan.requiredFree(mins) + if err != nil { + t.Fatal(err) + } + if err := plan.admit(mins, required); err != nil { + t.Fatal(err) + } + if err := plan.admit(mins, required-1); err == nil { + t.Fatal("one-byte shortfall accepted") + } + } + if required, _ := candidate.requiredFree(mins); required != 56<<30 { + t.Fatal(required) + } + if err := candidate.admit(vmStorageMinimums{32 << 30, 32 << 30}, math.MaxUint64); err == nil { + t.Fatal("candidate bypassed legacy scratch minimum") + } + for _, plan := range []vmStoragePlan{ + {31 << 30, 16 << 30, 8 << 30}, {32 << 30, (16 << 30) - 1, 8 << 30}, {32 << 30, 16 << 30, (8 << 30) - 1}, + {math.MaxUint64, 16 << 30, 8 << 30}, {math.MaxInt64, math.MaxInt64, 8 << 30}, + } { + if err := plan.admit(mins, math.MaxUint64); err == nil { + t.Fatal(fmt.Sprintf("invalid profile accepted: %+v", plan)) + } + } +} + +func TestVMCapacityWriterChild(t *testing.T) { + path := os.Getenv("WOOTC_TEST_CAPACITY_WRITER") + if path == "" { + return + } + file, err := os.Create(path) + if err != nil { + os.Exit(21) + } + defer file.Close() + for { + if _, err := file.Write(make([]byte, 1024)); err != nil { + os.Exit(22) + } + if err := file.Sync(); err != nil { + os.Exit(23) + } + time.Sleep(5 * time.Millisecond) + } +} + +func TestVMCapacityDropCancelsActualWriterBeforeLeaseRelease(t *testing.T) { + root := t.TempDir() + path := filepath.Join(root, "writer.disk") + release, err := acquireVMLock(path) + if err != nil { + t.Fatal(err) + } + defer release() + parent, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + ctx, stop := guardVMFreeSpace(parent, 100, time.Millisecond, func() (uint64, error) { + info, err := os.Stat(path) + if os.IsNotExist(err) { + return 200, nil + } + if err != nil { + return 0, err + } + if info.Size() >= 4096 { + return 99, nil + } + return 200, nil + }) + defer stop() + cmd := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestVMCapacityWriterChild$") + cmd.Env = append(os.Environ(), "WOOTC_TEST_CAPACITY_WRITER="+path) + if err := cmd.Start(); err != nil { + t.Fatal(err) + } + <-ctx.Done() + if releaseOther, err := acquireVMLock(path); err == nil { + releaseOther() + _ = cmd.Process.Kill() + _ = cmd.Wait() + t.Fatal("writer lease released before process reap") + } + _ = cmd.Wait() + if !strings.Contains(context.Cause(ctx).Error(), "reserve") { + t.Fatal(context.Cause(ctx)) + } + info, err := os.Stat(path) + if err != nil || info.Size() < 4096 { + t.Fatalf("test did not observe actual writes: %v", err) + } + if cmd.ProcessState == nil { + t.Fatal("child not reaped") + } + release() + reacquired, err := acquireVMLock(path) + if err != nil { + t.Fatalf("lease retained after reap: %v", err) + } + reacquired() +} diff --git a/app/vm_windows.go b/app/vm_windows.go index 4909ebce..07d80166 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -173,6 +173,11 @@ func (a *App) GetFreshVMCapability() VMCapability { cap.Reason = "The VM builder initramfs is missing." return cap } + if _, _, err := currentVMStoragePlan(); err != nil { + cap.Available = false + cap.Reason = err.Error() + return cap + } return a.probeVMRuntime(cap) } From ee7a61c6cf09bb9df5d6ed0f9b85fc671596c17e Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 19:26:43 +0000 Subject: [PATCH 20/33] Record native Windows capacity contract checks --- .../native-capacity-parser-tests.log | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/native-capacity-parser-tests.log diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/native-capacity-parser-tests.log b/docs/experiments/evidence/2026-09-26-managed-vm/native-capacity-parser-tests.log new file mode 100644 index 00000000..599cdd02 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/native-capacity-parser-tests.log @@ -0,0 +1,46 @@ +Verified SHA256 1ada1c8f4638760065f9d34d5858816647b82a74c3e079fee0d16e35656c8bf1 +=== RUN TestVMStorageMinimumsCompatibility +=== RUN TestVMStorageMinimumsCompatibility/legacy +=== RUN TestVMStorageMinimumsCompatibility/pair +=== RUN TestVMStorageMinimumsCompatibility/pair-with-conservative-legacy +--- PASS: TestVMStorageMinimumsCompatibility (0.00s) + --- PASS: TestVMStorageMinimumsCompatibility/legacy (0.00s) + --- PASS: TestVMStorageMinimumsCompatibility/pair (0.00s) + --- PASS: TestVMStorageMinimumsCompatibility/pair-with-conservative-legacy (0.00s) +=== RUN TestVMStorageMinimumsRejectMalformedContracts +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"other":1 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":0 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":null +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":34359738368,"minimumTargetDiskBytes":null,"minimumScratchDiskBytes":null +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumScratchDiskBytes":17179869184 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":0 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":null +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":17179869184,"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":17179869184 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":-1 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1.5 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":18446744073709551616 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":"34359738368" +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1,"minimumDiskBytes":34359738368 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1,"MINIMUMDISKBYTES":34359738368 +=== RUN TestVMStorageMinimumsRejectMalformedContracts/"protocolVersion":2,"minimumDiskBytes":34359738368 +--- PASS: TestVMStorageMinimumsRejectMalformedContracts (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"other":1 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":0 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":null (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":34359738368,"minimumTargetDiskBytes":null,"minimumScratchDiskBytes":null (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumScratchDiskBytes":17179869184 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":0 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":null (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":17179869184,"minimumTargetDiskBytes":34359738368,"minimumScratchDiskBytes":17179869184 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":-1 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1.5 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":18446744073709551616 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":"34359738368" (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1,"minimumDiskBytes":34359738368 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"minimumDiskBytes":1,"MINIMUMDISKBYTES":34359738368 (0.00s) + --- PASS: TestVMStorageMinimumsRejectMalformedContracts/"protocolVersion":2,"minimumDiskBytes":34359738368 (0.00s) +=== RUN TestVMStorageAdmissionBoundaries +--- PASS: TestVMStorageAdmissionBoundaries (0.00s) +PASS From 1294ae370f5a09f9546b541df9380d5397dbad57 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 19:43:00 +0000 Subject: [PATCH 21/33] Record fixture capacity inventory and physical expansion budget --- .../2026-09-26-vm-capacity-plan.md | 46 +++++ .../fixture-disk-geometry.json | 51 +++++ .../fixture-space-inventory.json | 180 ++++++++++++++++++ 3 files changed, 277 insertions(+) create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/fixture-disk-geometry.json create mode 100644 docs/experiments/evidence/2026-09-26-managed-vm/fixture-space-inventory.json diff --git a/docs/experiments/2026-09-26-vm-capacity-plan.md b/docs/experiments/2026-09-26-vm-capacity-plan.md index 652735b2..3149c33d 100644 --- a/docs/experiments/2026-09-26-vm-capacity-plan.md +++ b/docs/experiments/2026-09-26-vm-capacity-plan.md @@ -113,3 +113,49 @@ Mutation checks must remove a bounds check, swap the two bounds, release the lock early, or accept a success marker without its receipt. Each mutation must fail its corresponding test. Filesystem creation alone is not evidence of a completed install or a usable desktop. + +## Read-only fixture inventory + +The Windows inventory found no active QEMU process. It measured +53,979,086,848 bytes free (50.272 GiB). The files from our experiments +consume 4,576,790,880 bytes (4.262 GiB). Even removal of all these files +would leave a 1,573,664,416-byte shortfall below 56 GiB. + +| Artifact | Allocated bytes | Disposition | +|---|---:|---| +| Partial helper target | 2,717,515,776 | Preserve; no completed helper receipt | +| Installed QEMU | 1,255,998,954 | Keep until a replacement runtime is validated | +| Old probe directory | 267,311,706 | Archive and check test ownership before any removal | +| Cached QEMU installer | 206,615,928 | Host copy exists; removal alone cannot resolve the shortfall | + +The inventory did not delete files. Logs are already archived by the runner. +The raw [inventory](evidence/2026-09-26-managed-vm/fixture-space-inventory.json) +and [disk geometry](evidence/2026-09-26-managed-vm/fixture-disk-geometry.json) +record the measurements. There is no duplicate runtime ZIP in this clone. + +The virtual disk is 95,156,174,848 bytes. The C: partition ends before an +822,083,584-byte recovery partition. Windows reports the current C: size +as its maximum supported size. Windows cannot use the space after recovery to extend C: directly. This agrees with the [Windows extension rules](https://learn.microsoft.com/en-us/windows-server/storage/disk-management/extend-a-basic-volume). + +The shared filesystem sample had 37,363,535,872 bytes free (34.8 GiB). +After the cluster's 26 GiB guard, only 8.8 GiB remained for new writes. +This cannot cover the candidate's 48 GiB of virtual target and scratch. +The `local-path` StorageClass does not enable volume expansion. A change +to its PVC size would not prove more physical capacity. See the +[KubeVirt storage requirements](https://kubevirt.io/user-guide/storage/disks_and_volumes/). + +A concrete alternative is a fresh Windows fixture with at least a 128 GiB +virtual disk. Keep the old fixture and its evidence. First add at least +100 GiB of physical filesystem capacity on the storage node. At the measured +free space, that would give about 134.8 GiB before new writes. + +Budget 32 GiB for Windows and 48 GiB for target and scratch. +Add 8 GiB for the Windows reserve and 8 GiB for fixture assets and logs. +Keep 26 GiB for the cluster guard. This totals 122 GiB, with about 12.8 GiB +margin in that sample. Recheck the free space after the tests for capacity finish. +This calculation is a plan, not a reservation. + +Use a new volume large enough to expose the full virtual disk. Confirm +its size in Windows after creation. Measure C: free bytes before admission. +Do not alter the old recovery partition to get test space. A sparse file does not satisfy the physical budget. +Neither does a larger size in the PVC request. diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/fixture-disk-geometry.json b/docs/experiments/evidence/2026-09-26-managed-vm/fixture-disk-geometry.json new file mode 100644 index 00000000..e195cd31 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/fixture-disk-geometry.json @@ -0,0 +1,51 @@ +{ + "supportedC": { + "sizeMax": 84520468480, + "sizeMin": 30600552448 + }, + "partitions": [ + { + "DiskNumber": 0, + "PartitionNumber": 1, + "DriveLetter": null, + "Offset": 1048576, + "Size": 536870912, + "Type": "System" + }, + { + "DiskNumber": 0, + "PartitionNumber": 2, + "DriveLetter": null, + "Offset": 537919488, + "Size": 16777216, + "Type": "Reserved" + }, + { + "DiskNumber": 0, + "PartitionNumber": 3, + "DriveLetter": "C", + "Offset": 554696704, + "Size": 84520468480, + "Type": "Basic" + }, + { + "DiskNumber": 0, + "PartitionNumber": 4, + "DriveLetter": null, + "Offset": 85075165184, + "Size": 822083584, + "Type": "Recovery" + } + ], + "disks": [ + { + "Number": 0, + "FriendlyName": "QEMU QEMU HARDDISK", + "PartitionStyle": "GPT", + "Size": 95156174848, + "AllocatedSize": 85898297344, + "IsBoot": true, + "IsSystem": true + } + ] +} diff --git a/docs/experiments/evidence/2026-09-26-managed-vm/fixture-space-inventory.json b/docs/experiments/evidence/2026-09-26-managed-vm/fixture-space-inventory.json new file mode 100644 index 00000000..d2e8fc52 --- /dev/null +++ b/docs/experiments/evidence/2026-09-26-managed-vm/fixture-space-inventory.json @@ -0,0 +1,180 @@ +{ + "experiments": [ + { + "logicalBytes": 47369411162, + "path": "C:\\Windows\\Temp\\wootc-phase1-probe", + "allocatedBytes": 267311706, + "largeFiles": [ + { + "logicalBytes": 94832515, + "path": "C:\\Windows\\Temp\\wootc-phase1-probe\\disk-backed-probe-initramfs.img", + "allocatedBytes": 94832515, + "modifiedUTC": "2026-09-26T17:26:39.2716499Z" + }, + { + "logicalBytes": 21474836480, + "path": "C:\\Windows\\Temp\\wootc-phase1-probe\\experiment-scratch.raw", + "allocatedBytes": 142540800, + "modifiedUTC": "2026-09-26T17:51:48.5800102Z" + }, + { + "logicalBytes": 25769803776, + "path": "C:\\Windows\\Temp\\wootc-phase1-probe\\experiment-target.raw", + "allocatedBytes": 0, + "modifiedUTC": "2026-09-26T17:29:47.2042830Z" + } + ], + "fileCount": 39 + }, + { + "logicalBytes": 43052725817, + "path": "C:\\Windows\\Temp\\wootc-production-helper", + "allocatedBytes": 2820568633, + "largeFiles": [ + { + "logicalBytes": 91185367, + "path": "C:\\Windows\\Temp\\wootc-production-helper\\builder-initramfs.img", + "allocatedBytes": 91185367, + "modifiedUTC": "2026-09-26T18:08:10.9261067Z" + }, + { + "logicalBytes": 42949672960, + "path": "C:\\Windows\\Temp\\wootc-production-helper\\root.disk", + "allocatedBytes": 2717515776, + "modifiedUTC": "2026-09-26T19:30:25.1098281Z" + } + ], + "fileCount": 12 + }, + { + "logicalBytes": 206615928, + "path": "C:\\Windows\\Temp\\qemu-w64-setup-20260811.exe", + "allocatedBytes": 206615928, + "largeFiles": [ + { + "logicalBytes": 206615928, + "path": "C:\\Windows\\Temp\\qemu-w64-setup-20260811.exe", + "allocatedBytes": 206615928, + "modifiedUTC": "2026-09-26T17:13:16.9759705Z" + } + ], + "fileCount": 1 + }, + { + "logicalBytes": 10444800, + "path": "C:\\Windows\\Temp\\wootc-console-mutant.test.exe", + "allocatedBytes": 10444800, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 10446336, + "path": "C:\\Windows\\Temp\\wootc-console-redirect.test.exe", + "allocatedBytes": 10446336, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 1849856, + "path": "C:\\Windows\\Temp\\wootc-gui-status-attach-probe.exe", + "allocatedBytes": 1849856, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 1853952, + "path": "C:\\Windows\\Temp\\wootc-gui-status-fixed-probe.exe", + "allocatedBytes": 1853952, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 1665024, + "path": "C:\\Windows\\Temp\\wootc-gui-status-probe.exe", + "allocatedBytes": 1665024, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 33895, + "path": "C:\\Windows\\Temp\\wootc-production-helper-evidence.zip", + "allocatedBytes": 33895, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 0, + "path": "C:\\Windows\\Temp\\wootc-qemu-download.log", + "allocatedBytes": 0, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 1632, + "path": "C:\\Windows\\Temp\\wootc-qemu-install.log", + "allocatedBytes": 1632, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 6, + "path": "C:\\Windows\\Temp\\wootc-qemu-install.status", + "allocatedBytes": 6, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 6, + "path": "C:\\Windows\\Temp\\wootc-supervisor-trial-child.txt", + "allocatedBytes": 6, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 146, + "path": "C:\\Windows\\Temp\\wootc-whpx-enable.log", + "allocatedBytes": 146, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 6, + "path": "C:\\Windows\\Temp\\wootc-whpx-enable.status", + "allocatedBytes": 6, + "largeFiles": [], + "fileCount": 1 + }, + { + "logicalBytes": 1255998954, + "path": "C:\\Program Files\\qemu", + "allocatedBytes": 1255998954, + "largeFiles": [ + { + "logicalBytes": 67108864, + "path": "C:\\Program Files\\qemu\\share\\edk2-aarch64-code.fd", + "allocatedBytes": 67108864, + "modifiedUTC": "2026-08-11T19:20:44.0000000Z" + }, + { + "logicalBytes": 67108864, + "path": "C:\\Program Files\\qemu\\share\\edk2-arm-code.fd", + "allocatedBytes": 67108864, + "modifiedUTC": "2026-08-11T19:20:44.0000000Z" + }, + { + "logicalBytes": 67108864, + "path": "C:\\Program Files\\qemu\\share\\edk2-arm-vars.fd", + "allocatedBytes": 67108864, + "modifiedUTC": "2026-08-11T19:20:46.0000000Z" + } + ], + "fileCount": 3385 + } + ], + "utc": "2026-09-26T19:39:07.1258692Z", + "volume": { + "sizeBytes": 84520464384, + "freeBytes": 53979086848 + }, + "qemuProcesses": [] +} From f5275bc821442133b9434195598b77e81a0598a3 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sat, 26 Sep 2026 19:51:45 +0000 Subject: [PATCH 22/33] Gate experimental VM capacities on exact image and signed runtime identities --- app/tools/gendto/main.go | 4 + app/tools/gendto/main_test.go | 2 + app/vm_image_windows.go | 22 +++-- app/vm_lifecycle.go | 30 ++++--- app/vm_storage_selection.go | 69 +++++++++++++++ app/vm_storage_selection_test.go | 83 +++++++++++++++++++ app/vm_windows.go | 10 ++- .../2026-09-26-vm-capacity-plan.md | 32 +++++++ shell/Wootc.Shell/Engine/Dto.cs | 12 +++ 9 files changed, 245 insertions(+), 19 deletions(-) create mode 100644 app/vm_storage_selection.go create mode 100644 app/vm_storage_selection_test.go diff --git a/app/tools/gendto/main.go b/app/tools/gendto/main.go index e570f454..2bcf4b38 100644 --- a/app/tools/gendto/main.go +++ b/app/tools/gendto/main.go @@ -124,6 +124,8 @@ func goTypeToCSharp(f StructField) (string, string) { return "int", "" case "int64": return "long", "" + case "uint64": + return "ulong", "" case "float64": return "double", "" case "bool": @@ -146,6 +148,8 @@ func mapBasicType(t string) string { return "int" case "int64": return "long" + case "uint64": + return "ulong" case "float64": return "double" case "bool": diff --git a/app/tools/gendto/main_test.go b/app/tools/gendto/main_test.go index 72d8e52c..2af4c1a0 100644 --- a/app/tools/gendto/main_test.go +++ b/app/tools/gendto/main_test.go @@ -57,6 +57,7 @@ func TestGoTypeToCSharp(t *testing.T) { {"string omitempty", StructField{GoType: "string", Omitempty: true}, "string?", ""}, {"int", StructField{GoType: "int"}, "int", ""}, {"int64", StructField{GoType: "int64"}, "long", ""}, + {"uint64", StructField{GoType: "uint64"}, "ulong", ""}, {"float64", StructField{GoType: "float64"}, "double", ""}, {"bool", StructField{GoType: "bool"}, "bool", ""}, {"named struct required", StructField{GoType: "SystemInfo"}, "SystemInfo", ""}, @@ -77,6 +78,7 @@ func TestMapBasicType(t *testing.T) { {"string", "string"}, {"int", "int"}, {"int64", "long"}, + {"uint64", "ulong"}, {"float64", "double"}, {"bool", "bool"}, {"Branding", "Branding"}, diff --git a/app/vm_image_windows.go b/app/vm_image_windows.go index ba16be6b..85db9c37 100644 --- a/app/vm_image_windows.go +++ b/app/vm_image_windows.go @@ -3,6 +3,8 @@ package main import ( + "crypto/sha256" + "fmt" "golang.org/x/sys/windows" "os" "path/filepath" @@ -22,13 +24,23 @@ func currentVMStoragePlan() (vmStoragePlan, vmStorageMinimums, error) { return plan, minimums, err } -func createVMImageFiles() error { - // The caller verified the complete signed runtime before it acquired the - // image lease. Metadata cannot lower the image profile by itself. - plan, minimums, err := currentVMStoragePlan() +func selectCurrentVMStorageProfile(image string) (vmStorageSelection, error) { + _, minimums, err := currentVMStoragePlan() if err != nil { - return err + return vmStorageSelection{}, err + } + manifest, err := readLocalMetadata(filepath.Join(qemuDir(), "SHA256SUMS"), 1<<20) + if err != nil { + return vmStorageSelection{}, err } + identity := fmt.Sprintf("%x", sha256.Sum256(manifest)) + return selectVMStorageProfile(vmCapacityExperiment, image, identity, minimums, approvedVMStorageProfiles()) +} + +func createVMImageFiles(selection vmStorageSelection) error { + // Selection uses the complete authenticated runtime while the image lease + // is held. Metadata cannot lower the image profile by itself. + plan, minimums := selection.Plan, selection.Minimums available, err := vmFreeBytes(wootcDir()) if err != nil { return err diff --git a/app/vm_lifecycle.go b/app/vm_lifecycle.go index bc1d3bc9..d9011fc2 100644 --- a/app/vm_lifecycle.go +++ b/app/vm_lifecycle.go @@ -25,19 +25,23 @@ const ( // VMState records the persistent installed system, not just a process. Ready // means provisioning verified the disk; DesktopReady needs separate guest proof. type VMState struct { - SchemaVersion int `json:"schemaVersion"` - InstallID string `json:"installId"` - RunID string `json:"runId"` - Image string `json:"image"` - Username string `json:"username,omitempty"` - AccountOutcome string `json:"accountOutcome,omitempty"` - DiskID string `json:"diskId"` - DiskPath string `json:"diskPath"` - Phase string `json:"phase"` - DesktopReady bool `json:"desktopReady"` - PID int `json:"pid"` - Error string `json:"error,omitempty"` - UpdatedAt string `json:"updatedAt"` + SchemaVersion int `json:"schemaVersion"` + InstallID string `json:"installId"` + RunID string `json:"runId"` + Image string `json:"image"` + Username string `json:"username,omitempty"` + AccountOutcome string `json:"accountOutcome,omitempty"` + DiskID string `json:"diskId"` + DiskPath string `json:"diskPath"` + StorageProfile string `json:"storageProfile,omitempty"` + TargetCapacityBytes uint64 `json:"targetCapacityBytes,omitempty"` + ScratchCapacityBytes uint64 `json:"scratchCapacityBytes,omitempty"` + RuntimeManifestSHA256 string `json:"runtimeManifestSHA256,omitempty"` + Phase string `json:"phase"` + DesktopReady bool `json:"desktopReady"` + PID int `json:"pid"` + Error string `json:"error,omitempty"` + UpdatedAt string `json:"updatedAt"` } func readVMState(path string) (VMState, error) { diff --git a/app/vm_storage_selection.go b/app/vm_storage_selection.go new file mode 100644 index 00000000..ce21762c --- /dev/null +++ b/app/vm_storage_selection.go @@ -0,0 +1,69 @@ +package main + +import ( + "encoding/hex" + "fmt" + "strings" +) + +// Explicit build-time opt-in only. No environment or GUI field can select an +// unmeasured smaller profile. A release uses the conservative default. +var vmCapacityExperiment string + +type vmStorageProfile struct { + ID string + Image string + RuntimeManifestSHA256 string + Plan vmStoragePlan +} + +type vmStorageSelection struct { + ProfileID string + RuntimeManifestSHA256 string + Plan vmStoragePlan + Minimums vmStorageMinimums +} + +// Entries require an immutable image, exact signed runtime closure and recorded +// capacity evidence. Leave empty until the experiment has passed its gates. +func approvedVMStorageProfiles() []vmStorageProfile { return nil } + +func canonicalSHA256(value string) bool { + decoded, err := hex.DecodeString(value) + return err == nil && len(decoded) == 32 && value == strings.ToLower(value) +} + +func selectVMStorageProfile(experimentID, image, runtimeManifestSHA256 string, minimums vmStorageMinimums, profiles []vmStorageProfile) (vmStorageSelection, error) { + host, repo, digest, err := registryRef(image) + if err != nil || host == "" || repo == "" || !strings.Contains(image, "@sha256:") || strings.ContainsAny(image, " \t\r\n?#\\") || strings.HasPrefix(repo, "/") || !strings.HasPrefix(digest, "sha256:") || !canonicalSHA256(strings.TrimPrefix(digest, "sha256:")) { + return vmStorageSelection{}, fmt.Errorf("VM storage selection requires an immutable SHA-256 image reference") + } + if !canonicalSHA256(runtimeManifestSHA256) { + return vmStorageSelection{}, fmt.Errorf("VM storage selection requires an authenticated runtime manifest identity") + } + selection := vmStorageSelection{ProfileID: "conservative-40-40", RuntimeManifestSHA256: runtimeManifestSHA256, Plan: defaultVMStoragePlan(), Minimums: minimums} + if experimentID != "" { + found := false + for _, profile := range profiles { + if profile.ID != experimentID { + continue + } + if found { + return vmStorageSelection{}, fmt.Errorf("ambiguous VM capacity experiment") + } + found = true + if profile.Image != image || profile.RuntimeManifestSHA256 != runtimeManifestSHA256 { + return vmStorageSelection{}, fmt.Errorf("this VM capacity experiment is not approved for the selected image and runtime") + } + selection.ProfileID = profile.ID + selection.Plan = profile.Plan + } + if !found { + return vmStorageSelection{}, fmt.Errorf("unknown or unapproved VM capacity experiment") + } + } + if _, err := selection.Plan.requiredFree(minimums); err != nil { + return vmStorageSelection{}, err + } + return selection, nil +} diff --git a/app/vm_storage_selection_test.go b/app/vm_storage_selection_test.go new file mode 100644 index 00000000..8b9f3105 --- /dev/null +++ b/app/vm_storage_selection_test.go @@ -0,0 +1,83 @@ +package main + +import ( + "path/filepath" + "strings" + "testing" +) + +func TestVMStorageExperimentRequiresExactImageAndRuntime(t *testing.T) { + image := "registry.example/test/yellowfin@sha256:" + strings.Repeat("a", 64) + runtime := strings.Repeat("b", 64) + minimums := vmStorageMinimums{32 << 30, 8 << 30} + candidate := vmStorageProfile{ID: "yellowfin-32-8-trial", Image: image, RuntimeManifestSHA256: runtime, Plan: vmStoragePlan{32 << 30, 8 << 30, 8 << 30}} + profiles := []vmStorageProfile{candidate} + selected, err := selectVMStorageProfile(candidate.ID, image, runtime, minimums, profiles) + if err != nil { + t.Fatal(err) + } + required, err := selected.Plan.requiredFree(minimums) + if err != nil || required != 48<<30 || selected.ProfileID != candidate.ID { + t.Fatalf("wrong explicit plan: %+v %v", selected, err) + } + if err := selected.Plan.admit(minimums, 48<<30); err != nil { + t.Fatal(err) + } + if err := selected.Plan.admit(minimums, (48<<30)-1); err == nil { + t.Fatal("candidate bypasses reserve boundary") + } + for _, tc := range []struct { + name, id, image, runtime string + mins vmStorageMinimums + profiles []vmStorageProfile + }{ + {"tag", candidate.ID, "registry.example/test/yellowfin:latest", runtime, minimums, profiles}, + {"other digest", candidate.ID, strings.Replace(image, strings.Repeat("a", 64), strings.Repeat("c", 64), 1), runtime, minimums, profiles}, + {"other repository", candidate.ID, strings.Replace(image, "yellowfin", "different", 1), runtime, minimums, profiles}, + {"other runtime", candidate.ID, image, strings.Repeat("c", 64), minimums, profiles}, + {"missing runtime", candidate.ID, image, "", minimums, profiles}, + {"malformed runtime", candidate.ID, image, strings.Repeat("z", 64), minimums, profiles}, + {"unapproved ID", "guess", image, runtime, minimums, profiles}, + {"unapproved registry", candidate.ID, image, runtime, minimums, nil}, + {"duplicate ID", candidate.ID, image, runtime, minimums, append(profiles, candidate)}, + {"legacy scratch minimum", candidate.ID, image, runtime, vmStorageMinimums{32 << 30, 32 << 30}, profiles}, + {"16GiB scratch minimum", candidate.ID, image, runtime, vmStorageMinimums{32 << 30, 16 << 30}, profiles}, + } { + t.Run(tc.name, func(t *testing.T) { + if _, err := selectVMStorageProfile(tc.id, tc.image, tc.runtime, tc.mins, tc.profiles); err == nil { + t.Fatal("unmeasured or incompatible profile selected") + } + }) + } + selected, err = selectVMStorageProfile("", image, runtime, minimums, profiles) + if err != nil { + t.Fatal(err) + } + if required, _ := selected.Plan.requiredFree(minimums); required != 88<<30 { + t.Fatal("default profile changed") + } + if len(approvedVMStorageProfiles()) != 0 || vmCapacityExperiment != "" { + t.Fatal("an unproven experiment was activated") + } + if _, err := selectVMStorageProfile(candidate.ID, image, runtime, minimums, approvedVMStorageProfiles()); err == nil { + t.Fatal("production registry approved a test profile") + } +} + +func TestVMStorageSelectionSurvivesDurableState(t *testing.T) { + path := filepath.Join(t.TempDir(), "state.json") + state := VMState{InstallID: "installation-123", RunID: "run-12345", DiskPath: "root.disk", Image: "registry.example/os@sha256:" + strings.Repeat("a", 64), StorageProfile: "conservative-40-40", TargetCapacityBytes: 40 << 30, ScratchCapacityBytes: 40 << 30, RuntimeManifestSHA256: strings.Repeat("b", 64), Phase: vmPreparing} + if err := writeVMState(path, state); err != nil { + t.Fatal(err) + } + loaded, err := readVMState(path) + if err != nil { + t.Fatal(err) + } + if loaded.StorageProfile != state.StorageProfile || loaded.TargetCapacityBytes != state.TargetCapacityBytes || loaded.ScratchCapacityBytes != state.ScratchCapacityBytes || loaded.RuntimeManifestSHA256 != state.RuntimeManifestSHA256 { + t.Fatalf("lost provision profile identity: %+v", loaded) + } + if loaded.DesktopReady { + t.Fatal("capacity profile became desktop evidence") + } +} diff --git a/app/vm_windows.go b/app/vm_windows.go index 07d80166..ea159816 100644 --- a/app/vm_windows.go +++ b/app/vm_windows.go @@ -244,11 +244,19 @@ func (a *App) PrepareVM(cfg VMInstallConfig) error { if err == nil { state.Image, err = resolveVMImage(ctx, imageRef) } + var storage vmStorageSelection if err == nil { + storage, err = selectCurrentVMStorageProfile(state.Image) + } + if err == nil { + state.StorageProfile = storage.ProfileID + state.TargetCapacityBytes = storage.Plan.Target + state.ScratchCapacityBytes = storage.Plan.Scratch + state.RuntimeManifestSHA256 = storage.RuntimeManifestSHA256 err = writeVMState(vmStatePath(wootcDir()), state) } if err == nil { - err = createVMImageFiles() + err = createVMImageFiles(storage) } if err == nil { err = a.runBuilderVM(ctx, cap, &state, hash) diff --git a/docs/experiments/2026-09-26-vm-capacity-plan.md b/docs/experiments/2026-09-26-vm-capacity-plan.md index 3149c33d..5c74577c 100644 --- a/docs/experiments/2026-09-26-vm-capacity-plan.md +++ b/docs/experiments/2026-09-26-vm-capacity-plan.md @@ -159,3 +159,35 @@ Use a new volume large enough to expose the full virtual disk. Confirm its size in Windows after creation. Measure C: free bytes before admission. Do not alter the old recovery partition to get test space. A sparse file does not satisfy the physical budget. Neither does a larger size in the PVC request. + +## Smaller image-bound hypothesis + +Infrastructure expansion remains a fallback. The next experiment uses the +32/16 GiB trial as a control. It then tests a separate 32/8 GiB helper +profile for the exact digest of repaired Yellowfin. Its 8 GiB scratch hypothesis comes +from the earlier measurement of about 6.2 GiB for scratch. That observation +does not prove that the smaller disk will complete a fresh install. + +The candidate needs 32 + 8 + 8 = 48 GiB free in Windows. A new helper must +explicitly support that scratch size and restrict its experimental profile +to the selected immutable image. Keep the generic helper and old archives +unchanged. No Windows trial starts before guest measurements pass and the +cluster has enough free space above its 26 GiB guard. + +The host selector uses an experiment ID set at build time. Its approved +registry is empty. An entry must bind the full image reference and digest +to the SHA-256 of the signed runtime manifest. This binds the helper, +kernel, QEMU and protocol metadata as one tested set of files. + +A tag, changed digest, different repository, changed runtime, unknown ID, +or incompatible helper minimum must fail before disk creation. An empty +experiment ID keeps the conservative profile. There is no environment or +GUI override. The selected profile, capacities and manifest identity go into +the durable state before allocation. These fields describe the provision +operation; they are not desktop readiness evidence. + +The tests cover exact 48 GiB admission, a one-byte shortfall, each identity +mismatch, legacy and 16 GiB scratch rejection, and durable state retention. +A mutation that removes the image comparison must fail both the other-image +and other-repository cases. These tests do not activate a profile or prove +that an actual image fits. diff --git a/shell/Wootc.Shell/Engine/Dto.cs b/shell/Wootc.Shell/Engine/Dto.cs index e3c70e41..f9873d79 100644 --- a/shell/Wootc.Shell/Engine/Dto.cs +++ b/shell/Wootc.Shell/Engine/Dto.cs @@ -835,6 +835,18 @@ public class VMState [JsonPropertyName("diskPath")] public string DiskPath { get; set; } = string.Empty; + [JsonPropertyName("storageProfile")] + public string? StorageProfile { get; set; } + + [JsonPropertyName("targetCapacityBytes")] + public ulong TargetCapacityBytes { get; set; } + + [JsonPropertyName("scratchCapacityBytes")] + public ulong ScratchCapacityBytes { get; set; } + + [JsonPropertyName("runtimeManifestSHA256")] + public string? RuntimeManifestSHA256 { get; set; } + [JsonPropertyName("phase")] public string Phase { get; set; } = string.Empty; From 80d20be968845eaab23d7432e89aa36b3a9ee212 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 14:39:50 +0000 Subject: [PATCH 23/33] Bind VM preparation drive receipts to current run and retain integrated controls --- .../.gitattributes | 1 + .../full-frontend-controls.log | 54 +++++++++++++++++++ .../old-untyped-directive-failed.log | 39 ++++++++++++++ .../provenance.json | 31 +++++++++++ .../removed-guard-mutant.json | 7 +++ .../removed-guard-mutant.log | 44 +++++++++++++++ .../typed-drive-controls.log | 15 ++++++ tests/gui/gui.spec.js | 18 +++++++ tests/gui/mock-backend.js | 2 +- 9 files changed, 210 insertions(+), 1 deletion(-) create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/.gitattributes create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/full-frontend-controls.log create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/old-untyped-directive-failed.log create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.json create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/typed-drive-controls.log diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/.gitattributes b/docs/experiments/evidence/2026-09-27-vm-current-integration/.gitattributes new file mode 100644 index 00000000..817a7482 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/.gitattributes @@ -0,0 +1 @@ +*.log -text diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/full-frontend-controls.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/full-frontend-controls.log new file mode 100644 index 00000000..fd62a2cf --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/full-frontend-controls.log @@ -0,0 +1,54 @@ +[WebServer] (node:3170940) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) +[WebServer] (node:3170963) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) + +Running 43 tests using 1 worker + +(node:3170996) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +(Use `node --trace-warnings ...` to show where the warning was created) + ✓ 1 gui.spec.js:30:1 › installer — launchpad (variant selection + system info) (1.1s) + ✓ 2 gui.spec.js:42:1 › installer — validation gates the Install button (535ms) + ✓ 3 gui.spec.js:58:1 › installer — progress screen (1.5s) + ✓ 4 gui.spec.js:72:1 › installer — done screen (866ms) + ✓ 5 gui.spec.js:93:1 › installer — session consent does not assert successful export (769ms) + ✓ 6 gui.spec.js:109:1 › control panel — partition-aware uninstall options (443ms) + ✓ 7 gui.spec.js:122:1 › control panel — personal partition without wootc-data label never offers RemovePartition (467ms) + ✓ 8 gui.spec.js:133:1 › control panel — uninstall confirmation names the verified volume label (332ms) + ✓ 9 gui.spec.js:149:1 › control panel — Boot in VM offered when available (§6.2) (267ms) + ✓ 10 gui.spec.js:158:1 › control panel — unavailable VM explains how to enable acceleration (259ms) + ✓ 11 gui.spec.js:167:1 › installer — NTFS defrag recommendation is advisory and actionable (§3.6) (402ms) + ✓ 12 gui.spec.js:177:1 › installer — backend detection is automatic; forcing systemd-boot warns for Secure Boot (441ms) + ✓ 13 gui.spec.js:192:1 › installer — supported family custom OCI reference is accepted (370ms) + ✓ 14 gui.spec.js:207:1 › installer — BitLocker offers unencrypted-partition path (no forced decrypt) (285ms) + ✓ 15 gui.spec.js:222:1 › installer — LUKS encryption options (§2.6) with TPM recommended (610ms) + ✓ 16 gui.spec.js:243:1 › branding — partner re-skin applies theme + copy (317ms) + ✓ 17 gui.spec.js:263:1 › branding — a brand build wears real assets, not the wootc name (332ms) + ✓ 18 gui.spec.js:299:1 › migration dashboard — files, apps, office (306ms) + ✓ 19 gui.spec.js:315:1 › installer — custom OCI ref defaults to auto backend detection (338ms) + ✓ 20 gui.spec.js:339:1 › installer — identity hides under Advanced only when derived from the PC (337ms) + ✓ 21 gui.spec.js:363:1 › installer — identity stays on the main form when it cannot be derived (258ms) + ✓ 22 gui.spec.js:375:1 › installer — the default form asks for a password and nothing else (481ms) + ✓ 23 gui.spec.js:410:1 › titlebar — frameless window controls reach the runtime (272ms) + ✓ 24 gui.spec.js:422:1 › titlebar — closing during an install asks for confirmation (413ms) + ✓ 25 gui.spec.js:449:1 › every exit button reaches the runtime (343ms) + ✓ 26 gui.spec.js:466:1 › disk size larger than C: can hold gates the install button (256ms) + ✓ 27 gui.spec.js:480:1 › a failed last run is acknowledged on relaunch (186ms) + ✓ 28 gui.spec.js:489:1 › a deployed install offers Restart into TunaOS (210ms) + ✓ 29 gui.spec.js:498:1 › new release notice preserves a form in use and opens the release page (1.8s) + ✓ 30 gui.spec.js:513:1 › release notice failure leaves the launchpad usable (294ms) + ✓ 31 gui.spec.js:521:1 › release notice rejects a non-release link (237ms) + ✓ 32 gui.spec.js:529:1 › progress uses backend labels while phase IDs remain stable (471ms) + ✓ 33 gui.spec.js:548:3 › invalid backend catalogue cannot silently use a handwritten fallback (0) (200ms) + ✓ 34 gui.spec.js:548:3 › invalid backend catalogue cannot silently use a handwritten fallback (2) (187ms) + ✓ 35 gui.spec.js:555:1 › last-run phase display uses its backend label safely (218ms) + ✓ 36 gui.spec.js:565:1 › VM-first account flow uses only implemented choices and supports clean restart (533ms) + ✓ 37 gui.spec.js:589:1 › VM-first action shows the next required account detail (650ms) + ✓ 38 gui.spec.js:616:1 › E2E drive observes the VM-first button and prepares through the real launchpad form (4.7s) + ✓ 39 gui.spec.js:649:1 › signed runtime setup returns to account setup without starting an install (377ms) + ✓ 40 gui.spec.js:656:1 › a release without the runtime gives an explicit error without installing Linux (304ms) + ✓ 41 gui.spec.js:668:3 › VM preparation drive refuses a directive missing schemaVersion (3.1s) + ✓ 42 gui.spec.js:668:3 › VM preparation drive refuses a directive missing runId (3.1s) + ✓ 43 gui.spec.js:668:3 › VM preparation drive refuses a directive missing directiveId (3.2s) + + 43 passed (38.3s) diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/old-untyped-directive-failed.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/old-untyped-directive-failed.log new file mode 100644 index 00000000..2e1aa8a1 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/old-untyped-directive-failed.log @@ -0,0 +1,39 @@ +[WebServer] (node:3168366) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) +[WebServer] (node:3168379) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) + +Running 1 test using 1 worker + +(node:3168390) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +(Use `node --trace-warnings ...` to show where the warning was created) + ✘ 1 gui.spec.js:616:1 › E2E drive observes the VM-first button and prepares through the real launchpad form (5.7s) + + + 1) gui.spec.js:616:1 › E2E drive observes the VM-first button and prepares through the real launchpad form + + Error: expect(locator).toBeVisible() failed + + Locator: getByRole('heading', { name: 'Linux is starting' }) + Expected: visible + Timeout: 5000ms + Error: element(s) not found + + Call log: + - Expect "toBeVisible" with timeout 5000ms + - waiting for getByRole('heading', { name: 'Linux is starting' }) + + + 626 | }); + 627 | + > 628 | await expect(page.getByRole('heading', { name: 'Linux is starting' })).toBeVisible(); + | ^ + 629 | const calls = await page.evaluate(() => window.__wootcVMCalls); + 630 | expect(calls.map(call => call[0])).toEqual(['prepare']); + 631 | expect(calls[0][1]).toEqual({ imageRef: image, username: 'alice', password }); + at /tmp/wootc-vm-first-current-candidate/tests/gui/gui.spec.js:628:74 + + Error Context: .results/gui-E2E-drive-observes-the-392f9-ugh-the-real-launchpad-form/error-context.md + + 1 failed + gui.spec.js:616:1 › E2E drive observes the VM-first button and prepares through the real launchpad form diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json b/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json new file mode 100644 index 00000000..5e3183f0 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json @@ -0,0 +1,31 @@ +{ + "schemaVersion": 1, + "base": "d39cc4a48adf5b55bf0a22ea7e498a8ff150810e", + "draftHeads": { + "418": "e85f9d6fa9cb03fe61623e76485349c878e8d47f", + "419": "4fb714534c21aea0a1241e9c4efc05d0b243c242", + "422": "5168dd5f9ea6ee96f64f235fdefd7b13913827a9" + }, + "featureIntegrationHead": "f5275bc", + "goSuitePassed": true, + "realFrontendBuildPassed": true, + "focusedFrontendControls": 4, + "fullFrontendControls": 43, + "actualGuardRemovalFailed": true, + "guestExecutionObserved": false, + "desktopAcceptance": false, + "scope": "Integrated source and frontend with mock engine only. No native Windows runtime, Linux desktop/editor/persistence or promotion acceptance.", + "conflictResolution": "Preserved main ordered installer step catalogue and root preservation checks; inserted managed disk lease; combined frontend imports and release notices; kept native typed drive/reboot correlation and extended it to prepare-vm. No older disk/NTFS/firstboot/runner/auth branch state imported.", + "newChanges": { + "tests/gui/gui.spec.js": "75ec57b2802bcefe8cc7a7f4c97ba1730eac442dd3e0fd3c341d4aad16b447f9", + "tests/gui/mock-backend.js": "64290999cfc96e5adf2f7f4eb53cf020d9b10ce15b493af2118e57a6d45735af", + "app/frontend/src/lib/e2e.js": "02d55c01f2b4e60c1c246b972627186e14d8cab3479ccdc1ec9da0ab3eb6f059" + }, + "evidenceHashes": { + "old-untyped-directive-failed.log": "632226e39aa0c35742a08f54576356db17622870e6e49cc91bacdbc6f37f8d30", + "typed-drive-controls.log": "cf24b3887dfd86f5d5b0b08902370321269ffb205aebc998c531f80088e08c0b", + "removed-guard-mutant.log": "e56510372206b0c7cae12d2288a4aebe3dca9beedbd469d7483764990f50c5d9", + "full-frontend-controls.log": "03cfc7ab0999c83b4fc6316a1af8982ca4b29e30eb67ab28a08c35438de1ecaa", + "removed-guard-mutant.json": "c5af4b0b52b6ed8903fd43d1d65d193021bc35f63376642e4427877ae2518ce1" + } +} diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.json b/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.json new file mode 100644 index 00000000..dbc3d966 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.json @@ -0,0 +1,7 @@ +{ + "sourceBeforeSha256": "02d55c01f2b4e60c1c246b972627186e14d8cab3479ccdc1ec9da0ab3eb6f059", + "mutant": "removed actual directive schema check", + "test": "VM preparation drive refuses a directive missing schemaVersion", + "mutantExit": 1, + "sourceRestoredSha256": "02d55c01f2b4e60c1c246b972627186e14d8cab3479ccdc1ec9da0ab3eb6f059" +} diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.log new file mode 100644 index 00000000..11bbf643 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/removed-guard-mutant.log @@ -0,0 +1,44 @@ +[WebServer] (node:3170408) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) +[WebServer] (node:3170423) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) + +Running 1 test using 1 worker + +(node:3170434) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +(Use `node --trace-warnings ...` to show where the warning was created) + ✘ 1 gui.spec.js:668:3 › VM preparation drive refuses a directive missing schemaVersion (3.3s) + + + 1) gui.spec.js:668:3 › VM preparation drive refuses a directive missing schemaVersion ──────────── + + Error: expect(received).toEqual(expected) // deep equality + + - Expected - 1 + + Received + 10 + + - Array [] + + Array [ + + Array [ + + "prepare", + + Object { + + "imageRef": "ghcr.io/tuna-os/yellowfin:kde", + + "password": "disposable-control-password", + + "username": "alice", + + }, + + ], + + ] + + 673 | freshVm: { available: true, probeStatus: 'passed' }, driveDirective: JSON.stringify(directive) }); + 674 | await expect.poll(() => page.evaluate(() => window.__wootcE2EDirectiveReads)).toBeGreaterThanOrEqual(2); + > 675 | expect(await page.evaluate(() => window.__wootcVMCalls)).toEqual([]); + | ^ + 676 | expect(await page.evaluate(() => window.__wootcE2EReports)).toEqual([]); + 677 | await expect(page.locator('#vm-prepare-btn')).toBeVisible(); + 678 | }); + at /tmp/wootc-vm-first-current-candidate/tests/gui/gui.spec.js:675:62 + + Error Context: .results/gui-VM-preparation-drive-r-69caa-ctive-missing-schemaVersion/error-context.md + + 1 failed + gui.spec.js:668:3 › VM preparation drive refuses a directive missing schemaVersion ───────────── diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/typed-drive-controls.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/typed-drive-controls.log new file mode 100644 index 00000000..76b4efaa --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/typed-drive-controls.log @@ -0,0 +1,15 @@ +[WebServer] (node:3169632) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) +[WebServer] (node:3169644) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +[WebServer] (Use `node --trace-warnings ...` to show where the warning was created) + +Running 4 tests using 1 worker + +(node:3169675) Warning: The 'NO_COLOR' env is ignored due to the 'FORCE_COLOR' env being set. +(Use `node --trace-warnings ...` to show where the warning was created) + ✓ 1 gui.spec.js:616:1 › E2E drive observes the VM-first button and prepares through the real launchpad form (4.8s) + ✓ 2 gui.spec.js:668:3 › VM preparation drive refuses a directive missing schemaVersion (3.2s) + ✓ 3 gui.spec.js:668:3 › VM preparation drive refuses a directive missing runId (3.2s) + ✓ 4 gui.spec.js:668:3 › VM preparation drive refuses a directive missing directiveId (3.2s) + + 4 passed (18.1s) diff --git a/tests/gui/gui.spec.js b/tests/gui/gui.spec.js index 4858f535..d88b4c5a 100644 --- a/tests/gui/gui.spec.js +++ b/tests/gui/gui.spec.js @@ -620,6 +620,7 @@ test('E2E drive observes the VM-first button and prepares through the real launc mode: 'installer', images: IMAGES, sysinfo: SYSINFO, freshVm: { available: true, probeStatus: 'passed' }, driveDirective: JSON.stringify({ + schemaVersion: 1, runId: 'vm-source-control', directiveId: 'a'.repeat(32), action: 'prepare-vm', image, username: 'alice', password, }), @@ -637,6 +638,8 @@ test('E2E drive observes the VM-first button and prepares through the real launc !report.vmImageMismatch ))).toBe(true); await expect.poll(() => page.evaluate(() => window.__wootcE2EReports.some(report => + report.schemaVersion === 1 && report.runId === 'vm-source-control' && + report.directiveId === 'a'.repeat(32) && report.action === 'prepare-vm' && report.vmPrepareDriven && report.screen === 'vmpreview' && report.freshVmAvailable && report.vmReady && report.vmProgressStage === 'started' ))).toBe(true); @@ -659,3 +662,18 @@ test('a release without the runtime gives an explicit error without installing L expect(await page.evaluate(() => window.__wootcVMCalls.map(call => call[0]))).toEqual(['runtime']); await expect(page.getByRole('button', { name: 'Back', exact: true })).toBeVisible(); }); + + +for (const missing of ['schemaVersion', 'runId', 'directiveId']) { + test(`VM preparation drive refuses a directive missing ${missing}`, async ({ page }) => { + const directive = { schemaVersion: 1, runId: 'vm-refusal-control', directiveId: 'b'.repeat(32), + action: 'prepare-vm', image: IMAGES[1].imageRef, username: 'alice', password: 'disposable-control-password' }; + delete directive[missing]; + await boot(page, { mode: 'installer', images: IMAGES, sysinfo: SYSINFO, + freshVm: { available: true, probeStatus: 'passed' }, driveDirective: JSON.stringify(directive) }); + await expect.poll(() => page.evaluate(() => window.__wootcE2EDirectiveReads)).toBeGreaterThanOrEqual(2); + expect(await page.evaluate(() => window.__wootcVMCalls)).toEqual([]); + expect(await page.evaluate(() => window.__wootcE2EReports)).toEqual([]); + await expect(page.locator('#vm-prepare-btn')).toBeVisible(); + }); +} diff --git a/tests/gui/mock-backend.js b/tests/gui/mock-backend.js index 035f874b..5fcc802d 100644 --- a/tests/gui/mock-backend.js +++ b/tests/gui/mock-backend.js @@ -80,7 +80,7 @@ function makeApp(mock) { StopVM: () => { window.__wootcVMCalls.push(['stop']); mock.vmState = { phase: 'stopped', desktopReady: false }; return P(); }, ForceStopVM: () => { window.__wootcVMCalls.push(['force']); mock.vmState = { phase: 'needs_recovery', desktopReady: false }; return P(); }, GetFreshVMCapability: () => P(mock.freshVm || { available: false, reason: '' }), - E2EDriveDirective: () => P(mock.driveDirective || ''), + E2EDriveDirective: () => { window.__wootcE2EDirectiveReads = (window.__wootcE2EDirectiveReads || 0) + 1; return P(mock.driveDirective || ''); }, E2EDriveReport: (state) => { try { window.__wootcE2EReports.push(JSON.parse(state)); } catch {} return P(); From 8e1c93e5a157435000cd3402dc07abdc95213081 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 14:42:47 +0000 Subject: [PATCH 24/33] Retain integrated Go and mock frontend evidence with English gate --- .../generated-mock-frontend/01-launchpad.png | Bin 0 -> 62129 bytes .../generated-mock-frontend/02-validation.png | Bin 0 -> 60249 bytes .../generated-mock-frontend/03-progress.png | Bin 0 -> 43243 bytes .../generated-mock-frontend/04-done.png | Bin 0 -> 58328 bytes .../05-control-panel.png | Bin 0 -> 51410 bytes .../06-migration-dashboard.png | Bin 0 -> 72700 bytes .../07-branded-bazzite.png | Bin 0 -> 62518 bytes .../generated-mock-frontend/07-branded.png | Bin 0 -> 63747 bytes .../generated-mock-frontend/08-bitlocker.png | Bin 0 -> 77683 bytes .../generated-mock-frontend/09-vm-mode.png | Bin 0 -> 48688 bytes .../10-luks-encryption.png | Bin 0 -> 62158 bytes .../11-defrag-preflight.png | Bin 0 -> 62626 bytes .../12-vm-unavailable.png | Bin 0 -> 49592 bytes .../14-bare-minimum-form.png | Bin 0 -> 68922 bytes .../15-vm-first-launchpad.png | Bin 0 -> 67948 bytes .../generated-mock-frontend/provenance.json | 20 +++++++++ .../integrated-go-controls.log | 5 +++ .../integrated-prose.log | 42 ++++++++++++++++++ .../provenance.json | 12 ++++- .../windows-vm-runtime-2026-09-26.md | 2 +- 20 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/01-launchpad.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/02-validation.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/03-progress.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/04-done.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/05-control-panel.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/06-migration-dashboard.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/07-branded-bazzite.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/07-branded.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/08-bitlocker.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/09-vm-mode.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/10-luks-encryption.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/11-defrag-preflight.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/12-vm-unavailable.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/14-bare-minimum-form.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/15-vm-first-launchpad.png create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-go-controls.log create mode 100644 docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-prose.log diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/01-launchpad.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/01-launchpad.png new file mode 100644 index 0000000000000000000000000000000000000000..d2f4e703b0678af032d3e5fa16db540b29f3dfee GIT binary patch literal 62129 zcmd3OWmH^Evu@rHg1dWg2<{HSgS!O_?(QCf4DQYV!F>qsLvUwscXuCLE_u)T*8P9i zJ?GwkwR-n-)$XqDdg|%g6RxZ%jewH^PIw|x=?Dl8b+_7rHfT3d7#33nanTmsg6~4)ns)M>ymEP z-Ydz`GvzaF(FfM3e*F|k6~(xD%z_BUnG@siG%Gbj^d6Q_%Y3$FMgqgPWYTyTsA|8u%{l#IeupK2KuxLun%~ zEF|KVW=N1dH&#*HAb5l{qDG*gI`h(w>895yV-(>Y`R^~j&vp@HZs^8^@6qPpyPR*D z;;FC_jef~*Zv!;DWhy!R;?;w{6=R3_+xOF`EN^0{S59kpH7ilo!S2iB7t^Ey9-3t? z?+-A^4PMe;bNJ~Xp81h`YY*e9urQ@D?N=M_g|PoltFMK*FzF8MCfDol3d8jjL|@5p z@yh245r5nr$LP{%HhOT+_OEtaQ9a+S_QqB3rAne9EPVLCYS&vi6O%b|ApOR**{v?W zL9yZpqFzqoVljK6U4f&?c_cGGxk5tA#>Opk8C2I%U7GRqh8H{f#St#ddeq#+ZR`6m zF`c3A_Nw!fQH9NH?>{?d_@HWWU-PzY<%~u|;`|QfXIQP8Zeq4~e$%G)0Z}Wvo{mSD z8{3We!Mb=T@F$5{c18y)lkC?SQr^X?f#kYVf$8r-EWZ|b5_cGA5;2%DSqZdF(;lHK zlg|o*JTbF4XzQeP9q}UHJIna_0v_2XL-Li0Ap^O}Y=+iJw~dYSs+;0gbx3^@Qj06E zcB<|S$$*y{b@?ZH!+TAX`@PjQ+^aAV9HRG-Y)`YoG~z5$uGh{+cjA&OG+RFKV+Uk4 zZA?g@Rwlc!Sm@g7L<_C(u|NFVtvU6D?d^q@=HP*;hsDK8!1MJVgjXszIAOn|Mk43t zsYSLh0=|wfrxi=LFR70)tvgpPlnW-=Hx##D{8lEa_(v5X)bek8@jEf1Rz{2OLM$ox zeisl>cO06h4x9SaVj>M`wQ)+>ckZ~S``PqFr1`Y3V!V5`)ijku6p|W8Ea@O}eiqvp zBV%57{&dd}uHkpRTYn4EZlWRw#xRpL!+{KM^5F&+K+QH6%f9rP-qly%SN4M&s^|wA<#swp6 zl=C0eWk-LFZZ+2pzPW#t6pEaIFi*6A^6mW%WbL`3WiSeVI#Q8F?GK=iix%z7l1G5W zn*DRMoC^UQz;-Lg@qpjP!?*T18UlW58>350G(=YvPYvlx!CTW#8JX1#06*9A2*2(g znKS8r#?af=5>6g7^$C3#LA@LvWE-DeEceJKOPMN;Eh@r|kTAIX253Z5Pho z)3-63ScUWTKBrQFiY#5p@9r4sjCkt8c{nvfV8oJ;E=rlk*>dz{e}|xEzT`c3h#2lj z(GEK;+`AuSgopz2T`t$Y`g4U8-NE^#I)H(m6mLH(Y$xRoBYi?==-JDza$*ocB2XY_ zzahWXRmg2E`*^$wgU5a~+Dd&CT>*W_SPk&4JeEvlp^uc`hpEK?DNkl6dvGq0Ms`4- zpH^z*GVM{|Cd+o;NiL;=PKovqeMdwQjq%y`_1Dtm6j9S%lo)XcR(e=J75FO)B^*X! z6C?eq|Na$W)~g^vqtr~Uib9PsH%oHn)7B;L-jASB6l$SWX5$D)>1ypV_7+w<8 z;wAZAHP(GC6$fSe&Iu{9W>WH++)t^TiSeJTmu*WC%I2s3$uT7~H=Q=q@XH6u!3^;= zO_WKK2wY}Fl4+Hu_qdblWW20YSvfiJjEIuriw_7lc5!U@W9a0zW5DKOB_EVf|7|66 zE31&6FPrq7Hs&-y$zZR5hQ-?v+{*$sieQY_ z{(y?>Og}&4=JGxDONV^xs;ANLg)pA?ee&j|hl7Gd+j1dwdPW_6cJyM+&J%3pRB8%s z92#-If!D)=644+}YgztBePl=)9G)M%M|vX6yFX}vIV*y?5E@2CXRUg7_kG4dEH9y; zQGwXtwIthx3%jiB5lK!f%>~uw!o%^@N>p=a&CZ1P{T9;U@Zx6YT_p-@{*z|85ib6E zdO!|!6)sPw{%%{Z&LKwowLu|)kCub5E?OgQeh+q6*;O}QxVXwk;FWy7Gg}T>?XfQE zE6JC>m3e31^%_O#{LAg?5puJ+A2!|$=2SFBh&|bqIj0BpZ25R8qk~!~#Ka{_*U?9z z%^O^6r1mbK0)8YW)cy*=!!rwmD;MG8|ABqLcp9ldz)Y(aiN`U znQQZE_3|Tm2o36pPnsBgcom{77B?eGO`#*U->elRleyZuIy2|l)~%D>k6w(oN0H|^ z+vqn8DhUQmx;nF4fnscaZCp73F4eX!hbL1e^+Ul$4&~o8 zwwMd^LJ9{DGC~&#NhU@uOGQ>n(}*Z7$~XstGBvn9BRSC>6Ij}@vJAytT7QINDf-i$ z)E}}{mMHBF7p^m>o)e>=7B^xugQg%H;_=)3EXCVAO^*~SMEzm7RsDx-zR7@{yMjk= z4A#=_dNNN)<*uw)edmX?Vh-JsocG_`uYl%G^iQMQ| zBI1?733ws$IQ`|ZM-QY!3fc|q5yxAu?!>fRiIEnh!e~Eeaj*8nJcHPKBEGaaXGG7I zW>e?zv*a`bDHFr6Fng|H@G>E`Fn-?N&fh%eL`f3*2CDgGmF!{)@ z#aO7T4igjpb~3(WrLVI4wY9zx6BO2kLp#PY_AP_!PG)Bw5sfLSA32&yAG+Tx>P;P8 z!QrVV-koaU)vnkGz>v+4IqYa+MPy1+B)$=NZ%9nqAGaW9#&KY||9;AgI7ldq)aZU$ zwLefOAB6v@Op`}1lZa39v$CYD$;52XZuFinSrN3Hg#ZJZ8T+E&`-jIk$fPX|n?@>i;{b4Ak?@)MC$l_FB z)zW}yRQ$;dO}M!sRmAPM#Hm<+JRFxVOvtXPA{mOE%+_ zr{jBz5tg><^7!~xYaR9e6sG>`sjt?kGlABflRv3FP}Y$0bDr8*sqbM2`|{UF2^?$l z_f`xDchEw1&}dp(Vtuc?s&v!hTIuQzrn=ix5dJQjqme-*sJ4t{qkqH5Ho{zf>%bkE zZv-lR>swCX5;lTTtg7>#Vj*sa0Wq<^h%fpyQVz}F7TswcLJ~uwZcZ1wIl)`xrL9Cg z8Otk}ROSp6$m*SJ@seZ6;EvVFckXA{>{6PIVxrNTjffsuJ~>zJ_LPXAesnCc#TAO% za*PFNd)Rss?MERn3!n4aq1HA)uOd*lZko?1rfsZ#fiHOq%+P#D2bY&jTH0r{5(Jw6T{(@L*OV!G{yw-1~-R? zs~8mm>~%OdcUB%Y`y0Vu6~BY-Mwuyq3Ks3{+zKmuhBMIw=0}Uo`8Ib(XB#{sq$1Hp z=5wuT|KedxTPJ75CjEu{$>wxpD`O|@sRa?sn}k4Qix5;emfJ5uL-oF6#39X!R#%wq z1bL1v3OrxsV?u`HYBxtvV4~70d{>nflJ6`w;sW*6?gtG<&d zQ@Q@Vf6eM49ox5A7>-%%>}hXSe_s5%KT-X?)V zb_>qKBW|yIqIp9sRt0ODNAZfbwpl?TIS}c6Mn>H0Q|&tV)33EJR%$9H)VxxnE_rqx zOT?Az>@SWcu@FG09ya$17K6JTKLw`KiW9|NV{{uln1RQ>sfNL#Sp$2wHdDDV-Iyq2 z6+(q^P|*UDJR)l9SJ4s_rm7f_M4>dtgOQcdovQSWaLwzxLcdUlkFmJSd#?^;04U#k zjws-1m|&^d=RaIParCyao|RyHU(*xL9FBkw zYI}e>R|}(sTGmrWdaLUOiX04{B&h@SBQY(4g#=3;XQih<+eO`Q#oRP;S;>U{F5jhr zN&kdWC_63=_F9q{^9-Nqu}u|?>Uc1NyVG1+GhB=oHzQEstdkSh{mvEBh;|Ef>ToW{d5I37ddt1JE>(^De|EscfyF`KD1k_6%+0K zeFgaCeEk>dXbk!rufYr>GJSi85(B5zG%vsH7(#5nQx*cq6jh~wOb-mNh(p}GfXM_{`vdf%? z`h!rzVsF7CZb4=^NIp+M*P*k{d@+wNs9xy!MU(<`@Q55mhKH|-hYvCT{ipsPMGtuA zR`T?}inZSJ^Ds^uaksQzpEnVQ>n>P>`4b6@YVHbWZZKcRE7AkYxhiAgiq}lstm!(M z7w9)1-=})=E+<9N=^Ay7%L!1Xnj(WnIM}Vg_oaIe%zhGf;{d2fcRa$|;Ep@Lf~9t= zAUH-ZhO(ArLOLAqYug+r&aGUKQTTh@y>&E$z0Weeu*4G6kg#lp&#-nPI1Q#T;l21S z2lN;HpHP+xumoS5T*lvVal8%p?uU^&p|28GL1&3D zbtX*O6+Oeo_r$i}TC>0D2TivN*KGbvN4=98k>VA|LCdEgmWCgDc#9ctJ799;sbM!H zIPUfp@crLjj^x-M{yus4^JDOTnfdAc#=q3hr?4-)|MEKU6zF6B)dl|lZWqkS$w|P! zBY$y(H>$n=ub2G*w?F%@N&jtn|HoeN|45O@FGne@;L2+3g!C9vMJODaR=X-}6~w3LU=3n1DJb zfODw10J(Qps7Ir)R#%R9Mc&bJ+vn8+F1dffN z-)&*FiEQ3vcz{dlPTrwOKt-VI-%&s0FfaoBiuGFhlti9>2kpHEb;{8hYEWE=aC4n5 zYE&XkmjH*hS{4}BqD8eTyv^0wr`(7u?Wfs#4w|XMU+SX_pvyMqD_M}!Qx|fB(@=m^ zAE%qTmdAB^7P6DNn7Wu4C)(cwrF<~2|% z;AcBL+~H@IIEu2JMbZXoyf&rsh3|-~+ zt*lg@)6?@aBB%QxB@p45?xH?q^|jn1v{g;A7p?taSM9|w)AI=H_PFF_%c+)E$j@^+ zCi-^me7V}ijGbSJw0B%|;qU1HFS{nU6GeCa6vXEIA|x(Y{FFOqFkRJrlqH2Hw9$w6 zdbPiNpvUzXDgqWysRHiCphhBbo%%mR3H24YRLqY!IPxZ4 zw4RTf0pZ4&lpZIcmuRtP`{K1j;lL?+2wR$8zp&@tly%<|AX_{6D>8a&#pm!vkUD?X z+XHVBzRVadOx<7No59x!C>=ibOl&cx3!!Fb$KLJn`-#|SkfN&UY6zD%*xWb_b?4s3 zY%}-++q0)3^web6Yz}jVQ|h5*Z&m-6*m*yU&=gutlH=d>d^cbE*XPkW!8vbP{mubg z*o$yai8-S#l-Ns!Rvd`l`-NnH%qgtH%UJSli{yY>4(9DQ*Q5gvTye%qP?VNKpR@vR zX4H>Y{Z4=WC^}gp7*46A;^)cF>k%Xk>O@D&`9>}C70bor+RwrwRH1X>u1cEBGq>+& z6Uk=sa5jY+4T~(f`KQ9ELjHywwYtMTGmok^Y57kr=3d>;2~j1>bfoz~Irkm9IiiaCK5o$J6@dmVbz(I|3>t}@4!^5P zALn!|;lXu3xLejt&6^_uO^kg#D(+=L!KjV14Kq4>U%RQuxd>Wdl&F2+l-JD=42`&i z;x?hk(0N804BzNX^;Y_kdwYTb*mh>}zWE@y=%2 zgHz}(k^7@A!uw_}Ch~1&UvExMW=;Z+yU=M<7+X)$wM6`Hn>CytOgT*HQdVl+dDE>J z3|@Co=BOA{wVnzW*`7EbP=WgJD%F|C)?Wcrd@_5*bhoE)fW-7#r>k0z$^pe_ChzaH z_R}N!E#R2=j{LA+T;>kvc@b06KeIsj;vU>?&DYVbBHkO}a1J_rA`FiYhNpz5D`rwV z=zcl>M&C}FJAd*&GagU*A}_~%y?hb#(>9tS4-XSxWFuu+!Y}u7YB$W)w~fPaRJsF8 zoQ4@3Y)e)64mN}9=x8#`_PTH(YZx*H73sP_$BE%Wjxg~2A91x_B9;!9UlW^~lGIdD zGF}gdEB)RuXav+~&&RWRrvn^$o4PqoTn?T9SM}r5PdDjJp52KZE!C#3dG*&^v-`x9 z0i7%qZ?pKWldkF1MJkoWXEVJ%Dnq|D++c);M1_ISEm4OZwi(Dzf+09CLNVCxbP`?C zeaz{hp2K}4-6B1ey3$^@nQXmUL+jrt8)cq8wLHhu#=mKk<9RA`@sGt=bR%=?-A)T| zH~wTZ)wapasvlSXK?w59=wSO}Qlssn>n0)K?yQJh=Vqi~8D;Cu2FurT7NS966Mk{Q zfD`dyQvdz*)x$puV`1=_1~s-#;Qjq_0u6(|@afAqd_(3qd!BQZe#7yiZVo=rvg`5G z$#&LR7717MqHg{G1Al&s5OkA$^VLVB&1SR~N4Jb@1ZjESX2ylAisEIhl-gNsnsLou zW39ASAJDIEZb(+-DIHoRv#~0vG!tMgzRAX(5`H6OvOTo;N8_i2uY_ zcL9D^66r=kpMHIaCh+x0{UIY7&7fl+v<7Z(-&6;TNifeYFR8Q#4EL>7beLa2r2JdM z=T%y>pAV`G*4oNj+9AI7&K7G25oiIm{?Ajb8l8^N&wpK|59xmcO2B&Sr@w9Q*5Q!< zr|xXGeb6lGes7ym6R5aeXZ<=ixzya1a4POtz*dws80@0ENscpS@jo&rQ%Gycqtd@2 zX$P;7wV2w=sMzDXuVTqdDh^`8qQ(4tvsxZ6)Ep*+Vfb4Du@uTvh``5dAr#sAF|N)M zQUJI;*0^(GCwF-A3h{Tgkel_=c@AtLh1PSa8j~i=1y6Kp6DxzfzDt>%^2%`yUmIPR z@_a-EV@R%%VXWKYk!0);-GJ!HBVk>G3ru^=r{$LNx9gBNuDqp+A?;x#k`@#wlbnYP+YobXCZWaLFs*i{zsjS&J=5G-$LO9r3`L=)x?# znvxegHI;dXZK;Br1tXx#Q$F=Rs{5#i>%`o(-Z`Ucx3ZOegT^ig;crly;`Z6F{b0{l zLi9j|l;72q))#6bCaG9Dp6fEvEYCkW>(&&jl_2XNI5WOS=r6nV3vu{@_di?!p!z@_ zQN`I(WQJp(YFE@~2)lHl=C|@T{&)#f8y%>qC=bHjBDT#+6iTO}irNlY&tvs6vQ#eZ zG&LeFS~SmR?GBM|tnZJ)A_?G|gRjSN^TX{?92t`7LJ7hL$o20J%$D0$&OMeZZsAJv zEm2DvA#Gh^nyGT{Iw8Be)$>?Z*cX}FD@IjT7tKZ`LYv#@rd_OKCy#r(oUc^V^^0Sy z~(fF|0l$C3Q z&+k3;@KC%t#is z>GGy04NlleAiq5th<3p_H*i*(3X=tmnzs1UOe7i|QF-Ndt*gPvvS~U{!6}UkI(o9Q zJx1BW<$}H2=O@d-#cBaFw#%As()hD4afg~Ak1uVwNb8V(0&|Z3^3TUNhqxopcy^SU zt?m&knk#ES4uGho5t9}+o9Bc+o#usHNJYyEOCC|?h}l{>X&RR`7rCP&8lZw9r`mQ zlr7nfOM29xfv#B|qnLxITpwTLbNiQw79xhs$~53tD`MMm5q^age;um@t2evDW=SvIulkPYn2gn=Mi9e2I7!uE~ePI*%`=2+o| zB@CYH`bKzZHyg}$;DOG9ytti0{?M?Df+Evs7wQb18{VUa(8a6*H@E$v4QOv?n@Wyp zbasE5ml=b?f<4{H*UGv2r&m#P(dv5MC3c|>riaoISju>ZiXi+TWR;%+UXdG^mMy!7 za1k1z=Dj&1FAt$p>|-FTH$kj+HFDQ%nO=0;OmauRNWcy+95gT{&gxs2NsUNzub@4|Lw zv|lBa${%oQyY-cVnk`&m$du=X$ZzMO6t2S^ZSX5Xg$7kun zU*V@O)Q**{zEhvY)*6;TK$L$K;@a40U5)aMjyP|qcOAZ)jyw9k?JyCKY|T?Oia)+^X=6Y0;+}!Fv8pnP&QdKFb zFK$qBaBg}E(STzMmP@zg!HLcg7Gi9WiX=jG zvV0eeg(dVuvxfQ(36+KB5W%rer_cQi{(8)#+@g}k5+kqy9bz{I#>d$yU^qBqTN~tvY`?K^=;tD zcIiDxIdi2Qm!|C0WckH<*;z+3$AE2?&1Z^p!Xpj_-imG|qeZgDPN zNV99_f_zHxrKlTzDoU@`296wc>8tg7yhTK<=7qD_YfQ5!Zfdm@JgnjTawz3m6&@R$ zFMM&>py%f6OIKR%bvVq=C2Rca&v}KIA8Te8!yJ?&2G>9F=WWut@~H4<*mF_*=6&#r zyu!?llk&}1ixbf?&b39xpik5WjeZvkpHS`TgUcl0E?XdCh@TAmF~4^nFuY0Q<`R+- zhDJ<3L0kS+fi1_H_qAmtUaM=1x(L%bJmf)+M`HiGS{tr!pEbRKv8IK`r+C0`m*Q!* z;0Qf>Nejo|-X0m0t;a9zsBXRgaJ6`nroO0`^YQbwBRdF+WlQY4H4%$@UrK?zim&etu?Q2zDOGDdu7xkWiBSQgzMJYt_r=ya*Wculs4^_vqZ8Zu3mEG$G-Uosm~*O?rzVVe-i6 zA*Gu>s*bl+URT6>(1cwwH|l7;eh>L_R)MmC>LhR;^`ok@N+^*^Est5deus;je!ceR?%Zn<0`w2HI4PSxBgCO*cL-O7$ zLicj|7-Mg1UWpn)FR`7Wye}4##Buqt__w4Afr=RSTaD(qIJ-|W$19)37pqTjQ_gcd&{ICL^AMl(JE>zXYm0_OmVZ+x zieGf`e(3@%wO0>vg?SJPnr}cW$_XIj4QWNrK2*&fYj96n6L+s&f6SB~ph0vq{ZNOB z>TM?Rg%ibN)5$myYnV^_dx-i8%F32fqszg=bVJ4U5pDrx9=}_S#)38gGqH+Z&K#2@ zIuyL+=7*(^^2I3PDKToKpb=C?pdU9^WLLFARkVj~YLb?!twE%ijVx^>P5Zg00TiTf zp2s}DvdBCp!yHyis+wU@5;-d8ibh&>g==1DAZ{fzx#&_dmK>i}O_3~f+Y)Na9n|7C z9<{t14oD0OHZ`}vOA4j%RbKKhfVQb^>V+=0e3Udc*0E~oFj+JwIOa2J;2*@owxnF&}I9(Mm>C=kw)Z1_K)5c%h4>5|^>pAfJe0 zU)ZSa6dEc5jE1OeiE;{dkybfM0|E2gTd0LMCb#7#(^p|N5;dT(7IB+==RtUv`^mu} zUcOXlro=t>3^s(Rm4?>3$?&JUxDA#EEHER##g8qs}pcx|~Pz+%=vRPbbXCWK9t zb7(XwiCvPS|FJ6FT4b`&ws`}@qy8N9R|%FnVRX2;g1qxnj)*@K3vk{|$ibmuonN6p1yziHkYMTE;aDmgt5YyGXV8#oiEyNUnOL5fUij__C9Cr(Gu)O2M1$gW5(5K zJ#j)l?hea$+=+wd-a>1>S6mqD*byH#b%|jqZA@0m(fnQj#j%_Wlen}Hi30$E7+$ZO z?$Tn5Zn9bwcdr3oO$_iqTmZ^P4loW4K+US=GgONB))C*8!uJ$H&~oo2?EUZb_=BYxDdf+ORZ~J_1O%s6eF;KJ zMDw1w(^KZ!g`SOILSz`}SW?{Zo{*4Ui(>Ypn>W6EFZ-0Anp7ppd1~rPvnWw3TPHTh z6FT#dm~5`4a(_hRk}pk5U2HUGLe}A`cRs~33yR`*5Fhmu$gaBE{&5;b8ZrcHC5L$C z#VHgBKyGamd2*Cqf65-On?DNp=KrX=G4C=1$Pg|+{mSqP0nkqp94AH=z@PbE2AZ^@ zHUY5=@wlM|SwGaKEQ^XGrK4kS!L2(7F!YcP;kJCeXn;S|Wd-U`_3Z~?&dUUte|Ujy zL2eBUy)eG&Z}e}gb~nZ6IV?7;FbE}lb<{QKT(X&?`kvZ^;~@l%i}K#6#K*6hNn;G6 zDPJ%Z*l|v#?i&fmRuQ8avS>2Dt>!T(7g^XYD3(D2L0axX*TH8st?qKVC6AmH$%#L70R^%)J&z{gH@pSa&v2FgFm4}}<>p4p2pzgOw=?yV=H&|Z9_ zaIM)z7(Yj+uil5EPOa9{YM_m_ZawG-%G`(vMvW8)I6Z6m5E3gAzs0tS^khfPrr(_O zvZ5VP>AH-&U~u-t1~Ok|+W;3!($lwX!TVD%kG}!=(|U_4n^(fnNQ{Ytp zM!6DvJPAQ@Z>lyaM&LqKfD}9vJq>wPTkzfcY{%fp#qt&~$(j3j6^nLgQRG;naFf?@ z3jZkl1>y_%=0153oT=}pHfF}J8&6!>v_8rnmYt6!^c+gw4|Tyz$Jbn_EIXK?3hz$C za&_0WiFrQosQlTA+kWY;UIIEZEu7k+n*HF{_+B8wuEc8jZh1qbeZc2_A=s*a-|CaQ zt+V_lwt)M=Pfjn}Pzyq#-fWH>O$Pyb!`I@0K?*!38UNdxpCj;`Sc0Kh^=Gf0DR+-~ zy0|VXOX;EBjal#q`wET;_lnM`z@b?BQI=2WYwHQ|?def1b}i%Hi`k`2mDl z8yJ6{869FN-CJH&&w2E_q>wuHl}%aL$=%ocup)B$8B|^NO!7` zz5yZBZ<)nbs-Y`Ac=aS=WA8A z++01>1BZ-^wWVkB=+$$j{mRP}R(%e7afL&6#*NxsQhHnU@LZJ_y1H`tnt^EO8#tmm zyX6xArMTG#>>!XxC{(jhpd4vrs7&PH1@xBtxUCUoKDZ^hr&DOQ*2TWJ(>OX zIr>JZEO!&b6vpxT=ci;0=n8kk{uLUiU`HI@Z9W}3P^&)!IN3kv;R?fiocyVKhjQji z)Bf7+X-t3m&=(+N+v+YY`m@w!YmxaI&FHvEZKh?o(r#sYyb@6dQ>Cu|#O(O`&RC-1 zYvXaAX<2K(h{ivo$_}*xwAt3!EV%XO8Q5>Y@P`f;!`f=ZH5G2gVS`2>@h;R`fS>;( z99(#eB4Kn&R@RAoYimo(IIOk?A!ShG7hy>cc#Mv+BWLG;^dbTF&f10|n2+A>q8a%5 z-$jQ&sI(4&#;zEljq6a|32|Ky79Hp#QHZO{TDhW2BHwKS$a(NhInw_8jnWjrul_9gzBiP=- z?Os>(+*3$+JD-wi_gGw*WmFF7LPgNv>_fgWkj}_b4O$M#&73R7D*&KEmP?oJw?WUB z32OmZv{c#8N1&{{85_(f-JIq6#Q4V}hZ@9QPX_=%{90A11`#B@l1?<+cIS)@$7f@> zd?^)uosE`Kmr_A=kS4G9n^f7WX(>UZ34lQd0;YnhhxoF{LBYiu~&Sr|GJ2|?_eu|rTc7`_i5Csd=m<*PVd^4Y*grn4f zR-QfQHRo3FdR&%~(=dK2`sdw`1x|(yMtQ~pg#`!6>A^c+VHF|)_hbCfETY=n+|C_m z1uv2x*qX1yqQV|bR!d$dw&jtVBtPi*|QJjN!e5q9LZiUKr&!xdg8_adwK z23QwChRbcC72Rn{FTPv#BD8=IW}Ta=xha+>XuyJQps&5q=mT{xmZZll2NOU%F4ju! z*Ii0Y#p}5dPw?-={+KcP?AxcKHndecUz3#$4&=NVjhCrb%wQ6xM~!%%j<{rnnlQO*82#iraglyf7`Joh?}DGdsbBRGFOb-|f3XVz8bV zICo-jBAbL=a|?D(530CB@XS&1@h6GFWe)|GP75EVnwHeh3d)|)2>3GbmaD12)31Q@ zzUg~I(n^rWm=eXy`s>D_1E|^Q!gvgIj}gcNACIYbqdyJ9Fg4{00m_l z-R5A@t_IT#^mHEI__OFi5T^4SO*jR9*(s@qeUB*;wL5!tImW*j62XF)6u`Y>CmCL& zU{24=ZP};K=*2+K+Y$_u0&k%AzJcKNstay9Hz@QN(j40pY;U zMK(RARH`VVWPAYWb~M}U_i*U0;t#TQ?*TFVRHG}&p6t)cBe*(r_^k*cr255RitG8Z zq*j!##$vUe-M0Dcr}c*89-jiY2YawiJSpnYTkUJ8^&P7)*KB*uAOR|&Bl=Zq4Sq)! zQPcN(AsinUOgvAOQUS{d$jE%Of_umcj$;HZal@;K+qLENhb;cs`~xOif`PK2_@d5bV$zG1mZtT^=$V}59bOJBx50^PoQV~s4d;;HzV`g`c?>#q}s>bg2vD*E+rBN~DoA4^59i&gL)Z z_|g55-+3YX`m+chy~ka<7N!MKASUEPuwCi-KCxUk-p%OEJE%o%tTkIZ{u-ifPi>`r zSuW;PXY)4z(5|>9(tXUAYFN@9?2!Of@O{W)ssTuX;4M6-Xc_SKI$K>Hahx?}Yl92# zvqBX*Ktc(80Wb4Q42r+uCHg2edwN$?;7rD~yIqQEDCkZNE}t6W`8=0tcp^5=-!BbY zAW@SB4PvE53={jS8B6TDD%QgzW-iaXr8t@9)Ign4O`bV%aWy}}cg6HLT!`^_^a!+f|FDqTqqYi5icTcqz{A`#J;*~k|vj>~9 z#Sf}I!3WhYQ!(ug(iYl7t&Y86o#*6B}4WRy)oz7L&5`M@bifr%^SW)m> z{0y9GHE=p4v0-0=74sRu=K15&Xx)16oJSPDi(Yg|z$r}Wk$p2jo@t8UQ}%9~mE_(H zVC1y>9DwzeYV}YWm4y2Cy+#w&RUmcxDaQj=K*{qiT2{F3<^(KTb1BiL>RPE5v`J+b z7B6r>7C$2|;?zwb%!^`qLs+-ITLJZifQ6z}b|sXQhbf5LIzZVq)6Fu?R{NZV^#MC;*R(Q`##sK$g3L>2 zPWl@U$?D904u(o^>4Xj~DKA1Q8m;?^DMZoY?dw`v;Ulp*7JuKLrc#(iy@mX(9;B>s zu&jBF_G%)PbmZRV5XIJ~O8iQ3$t9lzlgvZVap=|znS=Gg_y%*be^vI%M{ zDV+O7SvA82i&$;0ueLS5jU!>~L+ceSWWWWzNvD}3Ve!9N*6VbDaHQzrK- zX}5%sMH$+?2py{K90HO~QpEb#1WWwH2y#R@vEF*_$2+%k;C-FbnY2Y1VRE~);k~nT zZ4gPOL_S-Z;5M3SB9k#OO*GL)^))XHUldMvr}wor7Qu1Z+P+rK%7?_}%aFEQV%`66 z0S&vFx^vRekEj!vLrwWEw2fa#ZTMZb-o!Tr23|@h=m6{vuzf^jFyL0H_5}Ed1AAUTwgRUi&o`ItfJ5kDCpT&sx ze%4~q3O;la_P!y1!MY1-zx7r1gIi&ANqI|rmoWlNJ+A*N zUM^ZPBf}XN+$9fsLaB-=zyBLB8HP-;(Yg@Nk>`8*jl>Tj-aDmFZ(xxT(u( zZ5~@fuhrjv?-M)qe9+&BI+oTFx;tI%Fz{)DjD&qfH(lvCp15{O1;+62MKNnXbh#nr zvGNZ+?M#WY2;I-tcjK8SXhr`D4*y8exl9zS8=%<6oM>3d2aU0_R4v}c_f1?`obxTQ zJ4;2CsdC%?EWS0?z5Tl2BY%^Xu*Bm?i$X8&e<1!8jdte8{gWxm$R!aUwPx~g-+ybn zeE12cz;ZBFBr5#7>dIWdj6sz@bB*`$OvVSeiA=BcIf+zi8oDs;>#C?p(>w#}&u#y- z*B=kVY|muOjfezbY*nkxMc%A5ybi9#Y1s(-Doq}u)C)K)wRQ(n!TJt4*FF`u9?)_fhU-of+9(cA0zc9l~a?z;{C!c77Z`tqMs!(Z3srHmT# ze8m#3y&Vk67%f_Rec`#dh(KvvBP9_MZQP}OU8!?;D+>hCcWi`aj-$yCt-g*>DiP0v zExIgNGr@9{jnO&W=h8_Rk4oHiv5erPYpy_Etse>trTol+pllHYH+DJ&dn<2;0zewaqi za;_$xGj?q+EMOOK-aM9qg%Eyh%|3$(HK+Vh9%AZIErz#PE^5rLJ5hR>g00o`?$( z+ZRKWJFEsu2|IWTW@AQjJn71J@?tAeJc!o#u>3aZSoQf z#|}f&Ai=xuDQ|xX;lc;Z0bi&bzeXx{neK@Uo7UJj@63*gT39#zQOx;dAyGY*#}RyR zK(G%eSju0zzHCi==0$56H$cIhT8MzG&SO8m8Yj@MAtDN7BtJT2Gqjao%c>DaPcCs@3 zX{UORr@h5^6%zqAW{c%G%ENIfI}5UU6+9;}GZQ8X)?%?{NJ(Xm`4vjeiZZoYO|JWT zrL3~RPezFon2x(C*dA~j;NW*|ca~KA<^8)qJO7Khw+w14diRB?w@7ifVu9lB(&Fx} z1wwFlO=)ot?(SOLp}4zyad!=p-2Bgd&%EF7oI7*#DcLi7&0hQ2v$NLEp1f&`+AD!> z;jAhv_*6NrGZi!z1s1b~z8W*(*H#2e(IclSl~s!-9QD36X{3DOM}Wa2eJ9#=_upoY z3a}KDUn^`&ad+JW{?k?1PvTjBc^^N9gtXzmglrztw!A*2tdmyX60d}A7V!4mQgwqR zZo+MO`DJCruk!RbYy6?BS&PM%p++m|%ECr+5Y=$byPnN6m?)UpWMKKEGLJTar{d#4 zGM2bM@zO*DM&q#AYVFxNkC%qzfBx(2@p=fmib)qQvy^lke+>rExqXa#d?PRbwzAt% z*?g1M;Cr>B5PhJYdZ=!l6TN~DH;-zT5<)-Yd|~~Pt{G!yP>7SO;w08rKpJD`wG8rdG=-2 z{8t(hr<-vW0H1sB+oQ#>FPy{z4duL!bM-pSI#UoVKLk|=M%_Ack+eQrNVPihc0VZ< zai~K>0EX^o0%+z4A_@_HVdapE{+}=ZZ=}BbpD<9YoYr*mI_f4Z5d&t^C4es*tj7@37+sX;R(hDl3S+^9q?PqX|^ zpOTd!jdVdmZUq&$v`Y2b?Qu4kv@}&;;>3hG@8^70gby+;7>QUMjSX?oo7K^1qd(iD zRI}AsBggjPoPRqWLguPQ#}JF};1uho&g?;>RpfTbT4P2QU@Q6(?9R=-{W;C{hw{vH z0r!Ks8*Kf$r+4VxE_)$(H@?-{OWvI47jueUJoCWdyA1xhY-&8kP2di0zSE?#(O9Ni z8gF|xLiKK;Rz60n#3kRr^Pe)a5+lfypg^;I+yr`Y*kXVHi6M~`K~V@~x~TbE1bIR| zwH(Dh#!!T`fgycADt2Eyo>{?#WcQC-9){fG)-1ncsty`#5_JZa;bSm)3xmNQr2K&~Fr5Ch#Uy%2|(V4Vax1 zUeFCWklMuB#t!fMknkRioX1+gPT>qR`YJvedWRwmq|ziZt?_iyar%xE9R!e~HD|AJ zn&urBFCoS*9Qa7M9gNkyB>2s)!}cRNp$YLiG2TZIVt#+!ZQSV1leHn~y%bkLax?1= zxf3VUK`IA6WGmrH$19oLiFW)uz55GG2= z%g=Y5B{` z(+Xpb5A)c0V8)j$;t1?T&YV)@Oj#(@Oq+@83Hg+7!=zKv%{zrf)(m)G58_P=#W5xz z{H-4nlC`O7nXGF`&}x|3RVjv$YKHyErelbTN**ow#Uvnq6rC?F-Iq+D2iWCGMcc=} zOP+3`zWwnVH*yJ<8D#H0n6Ndl!=&L5@>a)4YvJ_Ue~SD-HY&RtF&>T!;i8IeE;6(w zQXD64S#$}g z4z>ACaU=#aYbqBrf0KpZxaiQEhdseQNNZreOstr*gZfp9nF`kTAhj^d-QX6j!$b*p zkn|#0>P<}pXqzMJ(NW2%8CqA(XS*fO^mG>+vlHsA2yf!?qprPA(icTf3Tq-lQ`=%` zUb9yXcec#}lT?NetP5a6iV=qOW zaL!rYnwQ6S5qwsuR|{a{T4tj?;JX!)?H$7G&kv{p1cw6N+x*zN*oVf>F zhaUSz7_5Tr1H0&KIQ%I+%3ppcTe!4z5(Kn{cBouYbFk<<5Mvk7$$Nd7+Z_Lkv082; zyfioddHYYZsHIl~T|CuT#EkX$om1@gL9~Wpv0hwv{Lr9i#z3jY$_0gfUQbUxETTX? zm3CO3IYUx}8iE-fj^fNF0gFwO=`sutvBRO z*~;uiSTD7rZqe)Pm$D|ts$kO3&XcB4+i|RwUULFN;Kz~*!O9#SaEJ!T9;^8(v z!BAAf7yaMAxzR6a)ndu8_l({KGK9+EKYELe{f1%T1`-3p{!L=qaiAWxCRE(QzDNhP zg|FHmL#m&XlvG18_`qFgG$pEV-M~=l%{UtfLU~vZ<)Ki)R7hMMmG#ZOk)SojhW;c> z(r9t}uHzZs=^js(_yrhk$a0llJ1mx!bwv0DU^-G`+70OVf<$~KE}2~X2iUa?eV5Wx zCM*7J*wcD$q1g3Hq4Mbe_G(GiI)DEuw@`4hRWML}c-1TDNhu8MDG?_`L(42Jua)0U zMY{i?WJ_Mf8774fV5V1V(zoDM@~j}OFn~SAE#%wTM9PYV_o2K0)zH{z(`+3R6 zUu{0bPJ^skutB`*c#05EYOy(Q7|AEomB;>4)KAFiZzqGSMu6WmKC{c(`ugct_s*Y` zUa!Fb{faS8JFR4IBCc3#pnN7Lv#vprV3mCwCLn?1&2{Zk(7x0@LL83Fl1O(_pC+Zn z+&)-vcr+Cn+vhO!TNErR92Bmuq4B z9&yj0@Av`s+CC~zN-xC zt2Zv9lQ|xq@X$(8ANe$Ha7&n|7Zdk4Uuv*>@qLBuFNF);8zM0hB@*5z1=9;ev>NWv zAcdi`uff75eN}_2I&k}$b{Rfe#4|i+5R-PRv@rvuw z_D)O;#(TMMeFWTcBBGh$sVlKGax>HHs%mO+acUBjn6Ht3T23C{R#c1y^!Ep~d%Nc? z@mwcxY&CJm_1ADifap)307j$P?=g?v1^T++}J=Q zKmNNao;!j+@3+%tddL>dl+4j{3V@oN`jHc+2uOC$$MkFV+B*etqYyKbd^u7I63SXT zx{ZBFvn!et&d;=w&*gDmsC59Ab&W@Tu&9-zyX3wnMQ6 zF8tTm6CwzK7VC_9X~)hE4u8h_+*~MVS>BLWrZ1>!GD2miuTSO2S& z{d5`V*w$;urTf*;=;F)}iFrO(0)@=uA8cpmEm?H5AHgU{&Dwe(&Ay}Fe!~xkr1GbO zq@y*P6qRjp>_af09vw68)utjnX*Ii0IablX_wE)HuaVM&2Z5Zrf5`u0Fv#R6uh}WZ z>~pY9#NnMXOS|9!_|$S&*>gVRQI_%KmxR03q*R|0w3hz%M{4S3GH7{-jjB5sP1-cYRoRd5%h8GD|8Pl*5wq$ePZPT@e_X&&iz05{qp-8 zGKL=OfY)Zr1G2}cGZ;AaZYyg&uXd+;Z)>VK7a1y6EZztR5(O1V+(6r?;66b7qh^t* zh>OUS{bn<0<)02xj9F39%H%eTy0TQV)5qsS4wh9j)SMrkFy46}xicq%Zb+%XL7!^p z6F8n=dS1GlaYf{sdAUmP=8pJ1ALY#SW@W(`1EWCV9`h9wo!8JQHP;=R#?I#>x2vux z9x!!U4)iyJqUf*JFF)T+?0vA@Ew8UI8~?|o8!pNGZ2^RCw@Q9_*BEPLxKYJnO3AFq z`8)X~eqld9fR)(V?GsgPKIU|&`ObtU6*%Cb6G@UbJLY^}&R_qPwDFI5h3EAK^z_Ha zl{dFm363A7Q2pgIlhaz81o^tBANIntcm!gyFZu_#sjpYf@7mfNi&Bjq2ZfHYQU+~p zOBb)lLdg=`JWA`X-Z6wzYJWUme!OG&fGU2;;CkAAKZ;UBp|5edIkGa#D_V1W?r9^_ zWaSZ1OT8fCw~xi=wyE*bVa$1y1~>gzGo*AJfTp7OD_qjN$$(Dwm--{d22iMW^E%V# z_*Os_bDI3I#~|8w`cPDSR`+JKwdzG%5%uY+@i+@6dMdiX<+Zw%B~sTCasXy6i+}T| zSWiRdPtHpg&Eps2oxPQ1Z-3mcy0CHmO(nV6@;;4NsT2Z)3GuK8td_e-g{?%WIMD)-DA^Ngf@S z5qwN4(lQ%MiQ~HWXX(hgebqH?N{}!*pYLel-<3?A$I2HKZr$pwXajvX6)II3`$Waf zKk$kAePP=Axr^JAJw6bKJ7%SquZ+Q z^r7R@m)p;@2`GNj+#`h77&NfEPwu-u_%KI3!p#PB*UL-OOoGJM3BM*lpW(zB+$a>S zECZ3k8LFxFzoxZ9z~9%M!I^rRA@D5sZa%b$lapy$QjQ(jqrBH$!>fL|xjmuDY}Vwh zo`$^_0~@yPUvlRJ^;Wv;KioC!*?treNLa}hbO`fEg|yr$f^A2qI&MYag5Nj`i_|?) zf~C5PrPo~Y%N*DY4JsrEf-b6GMW$*0aZ(WdLy~Ct@v?dcr3r`L>?kPY`~8%~fqNtB z-q&P>=s?HU=?Yctoyy6AMBihylgRl-DjzxBG*2XDX^MzYcgK4#soDA=!2OJ$s| zxvrqpuad)Wpgu;^VN2hL0~vCE@gh{(^1w040?@HMbJdFx%X(lVPiK#xwQ4cPCsRk?>>SR zbeUS<$f)o7Fax$xaXS%G&vG|a`S+Dk(ET#@ss#B5s;A0QOD?O}?f{FODp9M(d-tnm z+O^*a=e~6%UE;!^E9@)T`SQ`YS_iS0P*U&X)D|?Lv0}FN)89ymhtMQ=i_uu*P>kM6 z8k%%&vKEnPv7ky-e_%7pnYNT-LFvN-`HI(|%pYYLljZuds-f^7xj%4$o1^^&KS5vRj2HNP5vuy;JShlmhS?+rh&r?{^QH({n`TPig>f7vR!zQqqy!yMnH=yVqz zsd-16c$5W}(M1Y5=Nntx)G*NsLtjGw7B@#fTX|BVykp6-m&hs86tg>?MS~3N_@3eQ zJfqUG6~^qJswuI}_+!KUJoPpi%5Za!{os!#lG(u9$Bj~M-_&RIEjjxms)5pe5@ZHiU^o1T!20pjlj54%90VZ$Tu|s!s z%Cfw2o1r=Pdf9*O-t4IG)KTPu?gkfuZl3`YjM7h%I<|Z>s3Q zw)gp)>uyVIg+uPLqvHt-Th#uo2ulJB0-kyYUr0=N5I=qNnb6hPiXF_<`cJ#wy_Ozz zU>P`_p$nBBJ386&pYr5%UJY%ZjQp7H?z-(->|2TQ?20_EiM_=|sbMIi@zvFe95rK6 zPBSd+4ebUP9UC^$-SopYQPx z=H`;N>(9@UEnN6Xw4Z*rYN=uEt+8$pc?i0SMIt#vIyhhLv(m4!$l z^bjRC!7%8=gn-I(ZW=zO|B%kp-Q!iw)fKr2tROQ&oaco%L11pR8wK2!Di0c8?p)Jl zZ*+hekaJ>VLbN<)#=fHZUVoyw{2-=6z!F;o41dNRR8!mCELn2w<=oqgvt8ThxH#Z2 zf*4eYOFpAaRWu*<4+vXk{`mgb-f5sy^BgqrVm%%{5$lZkusJuu&S*1iA%TgB3OdF%i$8)jscj4O{9ntYWt zNIc3yoTNK@?l=6+#hRt2YmXvnbJNT#7G7X3Cl8c_xzs_jl9tFI^7o(j%y0VRq#Pj2 z#kRK7c*8Vd3F!J0FBbcswih8G+au69mhUWrX{u>L}0#bTi=hxEP9b?VXg{XkrG} z&9tzjHGA4;4DXs82rvQH^RC79`H6l`FQKDz8N;~R9$)6>vfyuW;5u2%B;@rD8ZSeD zt@gnP>4a#UZI;yvnS?Q;4tB11NmHj?OiV`9B?a@WTK9~_whF_Mh?GvZ?~LnBwt8vr z+?&L@N60;S8=C9e+l!hzEYF{0as4Jv{Y6Q`yK>RU{Y^N>n+vwcfM+nTYnYX(#nINW zoY@=Pv}o6VO)r$Hd+toh-6;#>hv3h7e2F{%;LiK?S++0d*^$G!PsQq4Jqp#lbozxn z)BzD+{UsfKmVIozqs$^!DN;!yAr2K~W<4sn70ex?C2`hW+MW3PQ?4hBNhf9M(eJm{ zej0fxhncu}*MZ!tAY*yYsnu1gtV}dpPUEZkaI;ecol5Q-ab==yCpPmbw;V6E)rooP z>!hpO-c>i3wF*8{v-Gc$@wBpnmz}5z*{fPv6olJd0cHM(Fz)PSj6d$@b{a@b-QKvc zhJ9wz#J-}v6S1wqQT6f z-xf0B>~^~5z131vej+h4=C3%m7tXuAaai*W=M8WfQdGf!CSiXjm^KmA>4hfb-DuaN zAvAVGLD@;m$UH(Vyyow$ed&MH?v1K{^`2ATb6)W3@$9m8cgS>lx*K2!`q!(GNzK8w zdJ*aN0F**x-%rNNL*H=YubF2A&eFS-Kre}j`N zf;|3w(P@7PhjZW5Wbg*^3epe>63vx0P9o?N5H5q}PQJ=eVl{cKm#HDfElfC`Jdk-o z`quV2#dM$eI{o|vJTAm%XELbuC3&*@ihDJpV;!zgQ1kfFGYCfwD^7r=HlBBy)ZpL# zS3H)elJ#j0cGPf&&P%d7^8x?DBP!i1`|t9HS2PS9e0kp7n2~Y3_QsUZLAI{k$YJac z&+Qf=(M6#5w!C`aF=aQw6v@IR3_hBOfemC|zltu4=KPihLxUnGLs}Eon8y*Yu)D`! zkr?I?*#dX0XxjF}ShFI}6q7Uj>h(3{3a7*q_wKmX`qprFD00S|clBSa$bG5y?GvbVjiCJOJa*Eft_!z+ z;;2pm#F95(acFcKGH?M8sWHll?f8V@z<~59*@q7oQz4p9F`v?Z}>Ql zO}}pffv+}<$7Pg`FN3bf{A=L}w5hksC~syYQCPqyp;xtF3Ey*GHam!w_p%R*L6PU4BA~jb6A+13xTHn;GWcxHvOl5spy@q$LrnP| zWzKE-v_Vd=+2h{@L$olgD+eUBHG~`H!6#?#f8NLh zUZUy2?&^>XUS}m)u8tmieuM_4HRHPvl4-l_fnnJ9v-GZEqi2^vlhvDVRshVwc-KZ` zzQV7OqUSTcFeUTkdtRWD6?!9LE-70JoTP4!WQ?OX3J8G8Rf zB8FBJmJsI#XYDRz{UnFJ)B1gMH2kkw4(2{#!@a+UXD~}G6-6>Mmhl^;8}lOi?PDKB z+ft1FCeG?V6bh89&L+h%Q*Xa(Dvi`t#e(cwwA?^h(tqYbCY~RWSVI{O8g+kLY539s zuQwGO7 zxzypvg_2Y}_7u6OMo`;ARbpzs%WegAMl2=%hr0bB@VO=a2H2T}pO+Rd}2+i0UsLwiv~ z4hKO(Tsj0YoH4cWE;-Uu@fU)RH>U}+{D|aW_OZqRWc@g?Edn2^_4Zn|2uhCbgbf&h zXNCDgr^Hi663s$D4LLRS@cjj_&r3YtpUJ&37Wm0!Bl<0spXgML$)_}r4o??KP7<#} zB^FZl>=9!%->35=a`3~x`^HPr80npJkHV>d(c`w#84RjK26kRJ*hJi)+@OJ7Mke`a z(}~3i&~#v^nGV~pDVfpZSxZj-{ZZII0S$~KjYPWa4|v0o%%fvNcx;fB(s@+W&ED(P zsnD3OvR@S_GCRs?oT$UP)1M3a`U701Nr}L7^^Q>wYH(?@?>T*T}PCY4zIQz=OqvQOM6i>XwbcjO(D~pLHo>6tLC}Pc)wNXXYC)&ZWr`8riaX4Ez+Lsr+kd5^+tNK2Az1XgwV>+2o90Nbm!H-R zeis?iprz2wrqbKG^-Wj3r+Ueia>n6fSE5#a-L&@uz49$zyrSZ#7xaDqcp`e z1lvVdx#3C9WlQCYb^@Y@&Ld zUBDib#EMpX9g>xbW$3iG&fe4z-)BOj;Mt z{Ii*KjJ34AZ(Fj_2HgO%x0)KGj%-vw_l`+-m2AI}xBF!;L>PMPd^Dk{GO$^j&Xz!% zSbyP;HN3ACsf=4W>V)1)1ru}fvJ~8mKWXlTS~Tp9O~Cf$<*C;<>>F}I0*U91vWAFj z>2$?GhHu$3mbpMIuH@%Ga5s2ZGmftC?@ryKM%XY87L~u#we;x$lfia=V4&q3HEXU*+-Mh>4lE zDBY*&o8s-(rbKY(@)4=M%D?R4d-z#1vDFP}SsPTszCOUqLu6$a(k6EkVlt+x90j!n z7Vd3taNp>YC$VxrHQAO%!6F2*niDlUPdBRIwZiolw`vm?-fqv{D+{+N_jutBjcJIj zoj)3+cz?11?o&s#St4-tfUjM+Qh4f!pwv<*Astt@3!QwKo)e-|0aVE0JmuwJ%Yi+$ z*uck%R-2T21F#=^t-FnP>pC@w3@Gn{4=x20msSM*b8q)-d+;|({50fxuyp+h zK9X42ceNJ3H?U?2E;4f$1;t^zGrLp+BtTGZPGfwAaO5J4ut>jjL)z_smX1v zyH^?_Xuq`eR?oS%Q!5Fe(Atq){BatgXrN3h1rw3R+cmBQX;YO2O)Ut3*^snI ziM0AJi9VEnE`mn<24L3olXpG(aQ_aY3tnP;u8(YUD`F z;Va!oR59L`kMWZZUwf9P%DDLTHS-EbWYPAa-mdL;uWpeb18rv%?Qz3qig~|dv3?nU zB-i1pnh@iZIFKW0OrErogQ}Mp zxkZ%GyDbLosD6j*fsfLn-7>8-iC#X13)t(H0D+mn2Qlsy^)W&b3J!m_E%lxH5iGzF zUH&JhA>8+fRG|OeQ?P2pnSA5<2sF>alW$NAa!*_X)u5_(z_oXusKnlK!mTD3_1%78 zTLMogAIKF#`*SI-rNesGxO=03h$Q5nmZn!dP{U)(GGeGh&rdN5Tqh09?PQfUJN&cr z-fJ&MlKZANq+W*Pxhg~dL~~GZsv)XmJQ&C6EtUnb5YJd=3H2lOnWhTeG9|#DuUzw? z{K)NYzjehvDal3k>v_E|^tB06v2>C2&@_BlqPXLL&0TCMD*c!X>BbKfM{WH(>eJiL zDyd3B6AJ6&$LHc)u$GACKVK1_7Gqt$kwR17}#n)`&s5kj=qI6{88}2z%kck`(u>>{AIIpZeNK>*e*srJ{dYR3VFD<2en(w`ZMkKPrI|TR2sygoZ z;r>!p(XHQTcP=O`Y`C>re!OtF7e-^}F)^~^&shH+m5?P*f@|L7SKmHdc#DaHi z5_&}~Z1;yF7bs|(WckZyulBBv_;M$IRNURwy7TaLMobUiLpJ6Z%;*04m< z-)$l%HSrwOF#iys`ukx2)i=C1makcTzpGlh9Un7zKNKjzuFucgw&C|%r_IGL%E8cF z&@Y7Eb#_r&cx2u&w*#(vPWjzbB1{=vJ1l9)uiShb&yA5Qf4gB*iC@`qz8*X;!D+wF zw$whd_(_h;*CNwM3THV){M1L#~uZ>XVC|E%=4hd!&LDLbN9A)D#YYTrBYS4y44YUuRKa1Ccw1Sn^@^g*l!hH)iVC`t;y$?T#)E& z!^8-)x*WZvcY_ow!2i3cxf3@_hhQW&~mfn!ZsqU+1* z+gZd@Gw60BI>d6K(JEhjzDPB`#MlB zZfxV{9LHRb!Qy&e45S~+zw(^+0FRvY&us~8=GIcVy)|!drY`Le81qCxRzvy8;4v6B z!z`?X^A#sll6%Z{;RLo%)fx=n!d<&QHdC7jNow&j+XHt%ud8@g7Ow&bUJ>TloC@&p zTvl~9G6qS6>oh;krjgrL(pIgeTX?x04NILncix;g!pA!9mm&UjgKag*Z|vbmp^Z8v z=&(co(VEc=7Krt3r>^sm*!`67+MWpt*mS!0lo_RFe$ zNAKVgUbu&+`?`OFt@qvLy>fS(YqVh+-|3kKlHY-7vhik)ooVZ-&FP@ote%PuZ&qQ( zo&4$>B42eA-ICc;7k-lQTAt*OUD}X$?;unhWW|=#@AX+LM z4Gcmir!s37?p1T^W9+>?$?zct9@^A(Q%id_RaG3mPadxD!Eadxd9{7iJIsoIZ*5)Y z02$ou3Hl81xm1HwS$i9OmGAU#nuCHEeGM}3OIsjiz0oOZIE1_tZsVdUS{s^rwhqk^ z8Lo8nW{Q4*n!DQudIg6g1|)o{fU(SKd;3gQzKb9K-v$+-4=IQCUH7+VRiFuS6YEZp z=d?V!SXzEXh6YpqKw6CL*E&*1wjX?i3F^!v(ozV`{I zN0#sq*2;Bwmt2|v)5kCH^@npg^7^sG^*?pCe!IV4tVrGwwmK~^z*iCZC;~3?3wI_P z=^{VkCl9*kXsUBIw4O#{#*MU7`%~_=sxM-%YD8ZJAyM8-8hd)mJjkD-NxCRPT|))w z;(xOJ+M5BLFFhU&44j4@gBt)V@U%m_)1gMgmj*5Un}eQRcB041<`0VC_VeRq!;HD# zY@U!IJ~_>uqK~ZZN`0L$4NG~W%i3GQ*Qwxocs;R^=Wz=TfDIzy>2p0FC!2vbusC&i zJzqWqsSfE9t3PjVFM*_j?+uPsMPG=^U`Iyengn@TA}tN#TQ?%df~`Q%Ran;ASr*jB zHuZ4vNsnk|VcoDB9(8a1BkKo?^^|#i)86hQ@=;rSp3AJRFhhfA zOFEh`vw_aY&b~yD_lvfECR0JIsmCgJS>NK!x^`Z*cW8QFr~&^~d{$m<&DKxQ><3-V zrou0=XIZnQ=M|O~C#>F63DMnh`k50|BC2!8;u}m`T)KY*qkQdt=3ItTo%V;i9hH~o zFU-%(Nz@xmhf8Db7{sxtldaEq-z^T=PP^3eW@z*lr|xlOjB)sJ^+nFPjeXuz<~{t3-CJq>sq~I%Q;P zU07xY=x~lrH-oRw8rKKTJ6r$44HV6sSY0#bW3eV^YEmi{LTgj@3qc|K6@DHX zs3(T=l8ble!|E+PR(0dry?#>xz<2$|7w4qo8|x_=j^&vv1PD)3!2vy zK(BlSa=4;QPOa~n2-Bnp|0YU`*$`Kt9$hce9Y(P4~ji>8<#3!0~kw;HycxY&g( zI@Oi({gflDaG@v}ZOPx5NsKLtj{k_o@(C6WgBYcgJFi-B{eR7WG--J9?oQgMEtTKf z5Mf**3AKrWf928f3mpw}nLj;e)X8#VHf{P~#jvb==X$Kw8%G$P)^PPX`m&_S1EV$aepz5WTVpz1?GpX2=*ln6;_=fX3pA*n)IacrQPa zY6D@pw`CmEoF-#RcJR{D>V*g@tDUy``>NQCw9ta<<9oMThD0WyhK)5>_IzXJQcy1f z33W;6)o!)Fz6&yB04OpW)-oG)^@aFVgKh85DYtuDL&~WYc<1Iz+)jEKZOPkR|6&f+ z9*=5%s9qkKPmqZSZj92Cu^!p15U|n973EoQ2 zPawv_+(wo!PdBweBQl-+ew9=-4ED}9G=>fMzy`1k*L?-W|UsI z-ZQHH8N}qiH(wP_|2NRZ^rDLs*O|+k$(ZLfLyf$1oda@WSi z@TN~UK;ZpnTd&51;%3LZ{R%@aSRgN)gZ)vbv1IqcUuZzUJ5oAZ+MvTrrQvPbff;2{ z>du&FVBVizOJ|f^1EvA`ma(&`BCy9LMQvsMxJ^NPVxJ6es@-v&`BD9`uC970&88?| zSD&}Xjx$j)c z3QH^d=*LpaFsfG{6OWGQNmY7GLrm11aGdy(On8c|j)-)}w!Qv*71WW`aZ67&QM795xGe4_?ah>HMvNIx$H;gV>z0r=s`lzHI^z^DvZ^*H*D2BTg*7{QvK>HM6NfP z>T#Ej2<}*JvE;em)Noc_xf`QBJuLH6=|A7N-re();^#Y>JS1JYC%|41Y?IwPc(!`d z5_sEKE(ho+4|3_BTsb#N*qXq2a?!QEWV+v==v6vjZra~TPrgzyV+gLSUZ5OO#8YZ; z7RBu&jIz}jc-+VHowC9-G^UOV}T=I88!W^ z2!JoA>n$+l(xl+3*I6#{?*5q)SB-43ZtUln7|gK2AnkLW=ka+u73;#;Vk6XgU1&ti z`d(dUpYdr|=<@Yw{=6|2@z3r422%3VnXj6w9h5=4c$J!&$N07P>Nd;k42Di4?*nVy zR+7kVL91Zz&q<61R;1Tg9A?8-_E2v+OtHBFI?i^}X_p*34 zw&FH)W|ZK2HkWq5!EWy2)#C`diCx(rVO2ZLTr)bi2x$|NV&5F0CP+OP^DM|iiN%v4 zm`}vUmA$4mpX5W+Wst?cw8Y0857CNd!TQst`P+NeoemOvB9!o#wEU*|Yhi|~ zWTGHVMh;)gdGhiZ+ODJE&H*RA-WO7f;$n+`bWZz-7C4V9pEYJx@@n@A2VBYQroF$q z0IfCxKhglQIz}r8zI6R2 z6>sS3mMgZQP=MZkFMt%ZJ}3M)764%WIz-1#Dv(bmqPTf+B*(5seV5onZavD396aHI zF(HwUcqR_b3qNspaczb)RaaNa8OB5G$~pQ9Wh$6jHDX39nY-qsL`@|@q1I821iev; zf-UOuWyq+FWohwre!H=pg!n^=qxKqp8Y>()zw2)~;^rA;V*kVdp=~q6zB|Q*z$pe(8Ncg7$$FZU2hgX;(Fv7^bh3cZ?R_)3!No7(_`F0RdnW2Z7mKI7;e^9i zU_z{S(Mjv}fK+Toug$!B{I^H18D*y1c2aG{FKx!8H}ZW4qX;17Do=4ij!nrcX9RqE zC>o=iT3lF=lEx3=MpWM__9b19K7*fwdwReh_tqZ6HS#*DDvoCO{gzIl$hlq=$wupo zVo?X&_4AhRcCEwJx-IG2JY=>GPfz)!xS{W?Trh-~UK1HfYK{#CZujqnW=v!wC%&PuvON;iik^+bNw4SfU9vo!F$}>9u9kTkVAzBLjP>JtoA% zV}=UhuRcXGGfM;9A*_-S8n>uRw4cp^<`%Hht@*}=PL05~DD!wq9Usrqaoww`N_h=y zp>u1Rg{;0^(_AQnbHp4R-+g4Vi!@`Z^UG~bnIM`p@>jdzdVeUXg0!>VUDxV0#<66X z08>ASP&vmo<;^?fwEJGtm`wKyaI1hlq=?0Tg4CvqpOpK-aAOczXN-mPM7s9THNs zNs)i|duRhZf5-|F8-n^i(Ki z2HX58YpF}ofr!expQXkR6<&Fv(VL++quaK;atB0LW?AoG(l6pl|7^^36UU!$1yB9yBT@f^wP&Q z&+|>@Ib}1Q3HS-c|AOPLoIsqBL^4kS!Q?IdM*#e-Y%-1>7 zO8(py`f<~@d2g3KF%qaHGFPjo3+_lxm4z4%Zgzbxi#y1`eESOnPd2{ji1D+)SZFOZ ziH%40&)+&j_Nx@(1)Y~h;3{4LISKl+J9kDW!aC=XPo(3PJ76KVE4jy$%Iq5LWCI?c zJ5{dsSVrv;{KYfyZZgrGNUF-B*u*gEA*0k(sILbNjUhfT{qs{Xw8^pTU6Er7m1oSs zk~|JcDWA{kkn98=t5nihA%bJGC3nKm!w>Q04En+Eq^V+V3eNMGUIB#tN$ox=8WAf>$~T_l?9HT`Vq;_Kk(Tka{<3cL_df3 zM2cGCXIh1k9=pT%%<-JqyOv(W>y#dv6j6)%c!A|Bmp*Gz5Q;Vv@PSYxFK3&}XlEE_ zL>IN_*Qw0f5K?k4w>@*I2u6kp+9UZY&GzVk!;w%wAsBUd^4$mE4RJ*BApab6KwQH$ zih!$hdtqm!kde_Omap%44~ObrS!u3A!3bPWyEo1?Whzx&7JbU=&?He&>oq8nmlw(- zKscWKyjjsN+NVFO)Zx+tY!+Mxy=^5Zz0vPxxcnjkY# z3R_qSUnR>emQ)N2HQ@+}XWV-a0!}JRRlN=z z&-El}_||gK5==fxXoII`=vUF^0~EBzXUdn;nM=#a(&)(fnDUr5*de|3iC&N1OxIiK zPQEFH6OeH!q*QNc%@`O)+;NO%aWRU6Bv>s_CRh4HNodif;CD zL;#-7k?U}9%bQWTSx*Iv{w`uqqa$DGbLRThJUF@BB`h&{+|SJs*1k;y9og+2O1QBf zOm=*o{^mAvx%n&9dOC$nP038dAlSTHB0J|0P=sRJy$Dh8s^C)SRn>6SrARe!{Z+wK z;AE<5mKa_3CpS3Mun*$Uzr)HJ-W5i5RZQxBbQ02IR>S%p#1oB5!mc|MEg0Dc{FJM; z-q9e>ZZ)%t@A}B3mW^RjKUUE~GPI+CmP(z#m`Q2};OB1MS+E7xycJnrBYr4Y@Bmy(#0*d{4M!kq`hTS9N*UNON92$4m)A{fB9sBJ2-Vf)V`?1HUUbU)f%~h-Bn$Pc9 zgK4QYx`s~lH^LQDI!up<79LqlfZ-?Z`SW&@9LIOg4|4<1-q8Wgl+Qksuho0zNQib; zlqzvG+=Y;_gZICr5r&k{#2PGdk*DGggg6eMRnv%ipKOR&BN;oV)>+B2^A_vc7sH$l zg6I08qgY+Hn5oGV)=~M>Zw`4YH7imq(UaekKO_=; zhbI~!`smF?g3kZx{dKViVx{K`X}xja;cuDzz_|pU-k^=Y0|ii*Qu+PQ?xNkze-hn8!Ad zfWU^mGWYknF!b2u2qW{f_mj-s;G#KxrWNx$N&qXrgkc%acLyv7sdljgEGBDbjhQ5_BGK_ zW9Lv2RHv_2d)%O3=F3Ft({cmTa+rmmTWF{YXyjj9a27%uIIopeYDO^Cu%tI{({h*A z&%fLvBa*4W#(z%E*TJ8PT7;}dT!Wt_F}pIDCIE$Ll%grFxckvWyk>;$^~mE*lQaPA z0C6F%>TFFu_~y9y%DB1m$_H^h38PSzn%WDtt+d4tI8Iu8resC$HfRHd^He0__yglp zhzD5r_~Y_Lv#LKxTWF-NwKgKkG;Ce#oER7|5X^`T#ud>1S}}=y_2QPpkYN0#&=d6k#s4BO{(rX&WM=biY$BI8Lc<#hubv3uXX-HVu zFM3G8mw`%&52H8~8EU}9$k)pEVaB)lu8gCi&q$T?$lbvp`m>+Vd9jLzWzJsNEWh_l znDl6b#v`Ee{4^`+t6+S9yHX^^6&H7cXz4BszE{*q z@f6}GtoW?SXacWkZD)-ih!lKOk&;Saz23gArcWIr5EBY)(>;DrF{h&+dt>!c8UOyS znvK1I#;Emjqk&Y1AY`%d=^?%DxSHPM{#Ijvr`~nhPHFB~aM|)hWCDw&$u;s>*5_;a z2;qJUQWY7ylLeio^`w;togzYiLmXz(XCrz0*j_L=2e0LjS#+ap)@0@&LbQ=cgf98kfnVI{{OxP9 z8uv`~4ac5?Gg%w?UY1a`JWkYD<}6*F4h4t}Whq0(uKRgY3~5vp_B~s{($vx(=5~I_ z8#moNr?+I-f%9L{@2swQY}Lz_4$eM0_2Rv*rtldG zlVoY(Vvt%mYDDN*xw+aw?V$1s$2At)Ki{?z4Yj{)q*mgipAe|z6Ifn!R7ryPz4tqq z)vHp!Jpm^1zdR>yPFxi_QGSmP>i0c~=7u7Rjr(1$D;4E}Z?(#jN;pqEx4CoURX^bk zA^o6}8Vb9r^U+!Lbcx4udMm6oo9hx={PO48Z{{vt(A@Oy{&jAiDnD!d;Y`_4dP7?$ zUaOZ+6qz8p9YykPCz|t0%k~3@!{gk?7nkIN*#bn%UQPj)0E%}!&$CGIqSvqzQ(^*; zCJTmwi&5SLw@5_!(g_5OZQVV`M5D(2$#ef2M#x+zBG^D6$6BzN9qga848b>Y{#53= zgv6VXv3tl);5-<&-z&#IIpgIG?p%CI6mUHsW*5~p&-sAOa%>NbT6t3?05rTsb$ae` z6V0RjP_x5)ve154(MZHauFSBmJ@|9A1uE&V_4ok3W6DdBt`pko=bgByzRd56#Ea}Zn)U&+%YQ?w_6a?(I>UvY|AkJKz!@{N@9@610`j{ z-D%=lkPplKPCb@+wb|=L{t_=XlfI%F^R921k-)$j2SIqquY4#R4x^L1>eKjl73$Iw z%6H-C5U+HJY|Wi&e87>~40}r~(*z4N!vj$N;OeGuacEnm12$1o zm{*Ey=u2q|nLq6cjES6yTxg!F8oV-a(*h>6fe8X=)c5Wq%P-&AED+}g*X0UvUccE> zRp6QljD!uYg_e$$)i3Lbc=`|XiMFLYX>t5+N<7&+4LS^^*J*iBgL5Im{e30#J!Jv1 zhlJ?Tqm?1`(BTlNkqOK@9kTTOKP+Qt=O5*Mg*fSL+Ik#M@dATiz5s|zL{w_ZO7Y(T zfzXOVC0(kr?w8+6T$6WF$ZB@=i+iGWMLN>wp|7F#miNo8|D6jc(4o=D*NiygY2sQN z{ztWsy#68n4J!8PuWbhf1ES>Vm#+(ntt3osdgzMH7UYF57-vCJT6brS%^zwIPRIEHuN& zzjwnp8g4xKuY+lq8Z-=<3m`Ol8qNRrH=M4XKNXBg8|y&i7~E93n#7=@x>T;; z|J9SXfj`?O@FKG_D5sAEb<3_a>Xr+$vc8A%5<|E){{2e!bEUY6sVRl*irbr5sG%z7 z%V^@HHR~+Z`T50T+Xws|PTx+{99N{@#3z(%Dl9c#RcLT(p-X&DFk{rlVH1L3sRo&M z>=$m8Tfd@7KbxSqDHt<^`p;a?vKip97~P*^ji?BRqH%1G_Bj2WBPBDk;Wh040zTHf zFn^m*Xr2%&q!7CQx(#CV^V0qXqYTVGZg_02Ow7U)r=wIrqZRdhTI%XB|88${J8wza z9}@z=YmMyxRN(p}{9uE%^uGtn*MB^0|Ibh#Ymoc4|le_T9GazHWrJ_1(w+;zAMb|(~R|30A4EU?Z6V`xZ8 zN&P)sLRwlH2*iLLk2gNf5z8Z|k`3=GObGWy=l&kD_}t%RlI^e|(!FE;54c{m?#tL% zBn)|A%5||8)%7Nzvfw2G?{D*eEXUyWfNRz7-Q>CCO-$ZI!)hquzVJ5b9`Aus{`mv2 zmErq)o~yGKa0@mi<^&uZTU9kgZ`ECV)sOYGXvr$gu@1)cpr)e2#KMB1GE%I7(DBId z@P$r4lC*b!ouS4EIXDsXszcvn()pb2-@M!t{6&J`U5&gD%|9%_XGilzzjj-)P3jox zH)Ty-_4Trx%`DZdDS5UBG_^U z4ia`6`Vq(&NF}h7F^QO@A51tP6E8kd+xh7khJfvR^>Db_>pKl9X0q;XH^=1USYE{g_ zkQTGE>i>qCz#g}=Giz{9Xk;V|&hcV#ZEgOFjb!|hCgT?u;yd1lMy?u3;&dYHEKw6t zPjpxbXcs^+26Ci|`myfDWp4LDA%p1ns;Qz7#xI}j(`<5d^7Itf*7lT^E|q+1(fb;% zP^@Z>lamwuMLxSSyMP|9KefP7e0l;coxW&N~u!ke7 zQlbi*JCNb?%F2LYlRy6+n`OlznryC4XJKWvXI_g1JL>S4X8GP8u#osYJ{fE-Op_M@ zS;3g&1%MZP1|8KEL&SF7q41k3Gb(pon zKg~G0{O!(o92#9Bc{pZKkqHCGSrO_Taz#Z@5_a}LI2;^?R-I+{8`S0OjEt_$Go@3O zbh(NOB8QH<*$$rvCC5DFlJ#}r3UxR8mifZ#D^JBtm(QA#wvV4YBmEdzodT=mV#xV*^2g{c9M=R4mb2= zfGTi1cntAULVFl<@J)=3bvG>U3YEmF`S;A`GAR7s0e!wP>;3m*+1z;PpkGrF{lOa zw%CfmVmZoKK-TQGm&&Vmz&_;BX}!oLIng_Py8sMExD>d5nntidN;X(>JZ!4$cooS% zF=|9e@jQZzB(loiayU>$%;VE?d|4zYlS2;YuLvWY=#l#SsdYYkP84PP9=o zs{HMw&?|g*{w+LWOxxj#HS_032UhD9y=a45q0PooRoT-kpPa<4#n?T(eWgU`{$XxEX z)`MMhmouWy*Sc3l|Ja#PzIY8@%39(42G`W`RRr|mFSaKS>>UsAgiV*XRTI2pNUulf zw&6bYjcjX$pA6E;Y)92aC-)XSKTg(6NId&5;x(~0O{lg#tv7t67Dkp5j?0knrkkFT zz-J4OBNzV%MZ%!Q5F4E}x>$GA(-?(2SfU(H;c6$+cs@v#*zE)5zZlP2Ij|B?E*jIJ zktiJ|Hx1y*f)Q9~P0>*;*F%>L9X!r2fIwg^%;nB4bN~;}ik z$AVn$7f*}lTrdrV&54&al1G9j%%5x&PfW0b=^;D`16wrOz#Ghmp2m`dQB|IHf%y9K zppXcNRO2fbuyt8Af@fXj@{i(1Cvnjmx#08g0nW#QaXhz&bP_(bUK1KbtlTk1Yn1aV=KG@;Nc!++oZKdp&1zn>DZeZ5mBKMtfx`l>gJkC#14}eu zFhc8Le(ZuQNbuRd^$oh+%z}utu9u;M%}NmP$=E*Nyo|`<KgHm50oQvSbS&@5_^*0=LhEk0+h^Dy6N24$q#VUR6pa9+47(ltnw-7OFjGFi2-dPIY_ilqX3zb^Ir}K; zV6HKFc!ex&*Nc}=k@Nh~ewD;oKVn<%cT|h?9mL6$_QSFT3o6?W5_zD_S}ly3!}4n0 zr5PE_N?G7mUF-Tj&c2LR^KwC~Z{go`RNshiypYFX1VRNK0N5AHFd(o|?xtu@cUa~2 za&0``IBp2}=R!VC#*7^jsjPGcZbw<0FP2A=8zd4jsg$;*0`)gEL5&L68J&l z%uCK2@vGSg5or&DRY}w}ieGBAgI{Zyec~de0q#xpX7C{|x{xhHUq@s#;qV z@BSLk#Tn!|LLmjWYJ*FxXTz1Z!)Fuw8a36KsqeY3#xj?u-TO~3K=$574TA;Bt~_|_ z&fJss3@w{}D!BJc&+hJ9zoKGY27I(k%QiCf$9#WdBS)ck-@xPNA|XvV?jYrS_F(-a z9^~$0gNSuCGlLP;kBQjMbqq)^Vpr+2OOJwZJkBrNovjKMQ+i?TK-&CA74AhQR<6Kf zbdwoGruqM!3;4a-`7mtVTzt4AcJ?5En>wX?*BDIf(@B2?C28}L;1fxTqsyHu86TU6 zT=jtkU2+6U9F|>tl?^|Q4Q3^>^zMvvX?d+L>k#>4n7zk z7rokcAaTD(!XnQ&FiC(ocbmyi`)jQspnE&~ByIU=*rpAZ==Ppl3HH6DN%KS6PD@t^ z-kF}`l;@(-VW=s-_qh!;;1SF%o+&|m%Ps!6pS`MrD{m2^Y-Z{ME?M>x-X>e@YZ0mU zJooSj^XGL|+&|<2758m8@AImewnubt%5OTlXanKbcmvP2(6@|=8|tOP$t#Vw-^}44 zjuS|ww0U43+$>*w7Bg-D-7RtavK85`cnx3ZPwzvU8B3ZVG6#W&&_NRfIj75c# zcbp6zRDRIzgyY5dO>uK)5iKL5C+f07-kWvc_;2XbM#zn=&F)_DJ=FesTI7TH; zk7YX~s}lW8Gb_=k2Y46b`~z~$nY}%*Tuvk#^1**oiBlOt0$< zKR5lI9fcaSRU_iOBRQGae@IuRu)FEW;&LVk<*^M681SGxtSzu-Vqf0APm2j}VQC!6 z)p&o8xrfXInOiRBAb%H~Lo@Qp?m!u+f}}EJQOKq9Vu! zgg2y`{7;U8I_1AO3aaCxc}Rcw`ZoGlW^_EogN&TEIadO%54rxR`uyOF=zGgjFp^w8 zx)pJ(_!S_((H0oGl^0q$$wH?+1XKA^%D&>;8dL<4~W-`1cWU%32PAWIZi1+rd+ zN29KQETRVp(6MKyXDTKScyD}7j`zqGNg~C0pG?JT>TDlwd*wQrO{VQv)GeH_qdddt z<4{&LHkqS49p_V>59AcLUu%%SR&Nwd>hy2j?(fr;q~Y&^2g31WS)7dN&aGP)gC%|{ zlgGtp%;s1U?}J!+F)zd@*!rTM?%W*f*O(nHUpt&{6k`JHnCj!Wk`mdr$_(Zc*njez-GlwItjFQJ9W>EBZ0yHj&KDSa zsE@QhTP)ZtC$l&bSfG$=Cc7c)ja3g7BPSc;+lSj`7K}Om#~YU(KUskAsVBsCB1fgh ziqstbomp@=7;MtHJS=!_ry(5og{99Ppiazd%!+KOt@CCGSr1VIN{u@4WO^IT(ilEd zc95`hAj)?amd!tLi%xE%G@0o99VUu+ho4LP4#I7bHH(-H_PZ*WBiQ&IPj-9N+L%6m z`94d|prP)N`iAL#K_Om4ch2@yjlGn~e1)%>OkaqKt@iv6wV(T1s9ziogO>c`MPu}f zmqBfoJC8n-aY`b!!1EY}U+27zkT%av`%C>4cU!{Ytz*CJ7#`dyk#la$Cex~Ty2T8b z#qSxYC8bfjcG{uOG*@#x&PD}Pv2Y6^K&{{d{F(j4N+4LcXMJ}YJ<;YSX|_|qq@Nl1 zvHf{ljNKXTTbVEnJa8e1Zt$;^mmb}!3#xI67`m+|VL;kowa0u-I`Efrgubv+!^^b*70}MMZo-NI5xj7qmbE*E7G|QkBZ`ul?q3FHY zdWwx+R;#=lT)sOq!omPE={heC6kgwacz+cpuuaw8-0e5AaCkTx6(wIb1H;qC-+qUE zwo>hS>iDQeC`u$JU+kS^tp(}2{9E%_VaLC zm3Z&ziAs3Rl?mF?LRXMMDSF<_GqGO|fc4z{V(djkBjl&{Oaz5GNH|BT#Kml|^6mig zT5IB~gjXyoC76317rcLw*{=Eth8nGqoF~k7cVESj_WPW{pkb|X2Htq zTcM)yJHi&KvtGI;Cuy$=FJPk~CDqTaf*d*D!}L~Zu(#;jZg=#OqDFxq^a6fOU{m|2 z!&+XymI&#B!!lK#3~<{G1Dv4l!}SsMGwByQS@A(U$R8QMRnekAQK?Rd-*TJJ>Sq** z0R105OX@N4Y;F>&PYx-(`mW;rrqrop{R?qs&D&TxN$z;1lt<8V{4Or#@ z$mQebDZ*y|c`~|r#@e9kXPc>WDrqV#J+Odv+5_G6esm!^Lxp7@+$>um^_gv<+!SoE z4mh?vp(u~1N<##W`t@H`&2QO}uh;g)QKCmiFq8c7 z)^@P}j$=&w_>;;yfxM;PMh9lxcSM1ouvr@?o1DVlis6p&nyN01yCVF#ooeECHlpcc zFFp`}*nR%!MteB;X!_k|aKM-)Mr*+kIWk%7#|7@7)$Apx0iST?BAGfS46-PY&0v0M zNJlL$4Yrcqz=ff*b&qy49ADwv9t;@2UDu5q+q$^X{%;j}PhOeBtmp4MaBi;=GNLnn zTH4aXAe~?!X$X_-r(h#{9|P!~FE}uYE!2K2fvdHqbX7i?0!OlqiZgQLr-~ymxTbb> zy@!kCol|i^$-pjYKbC2slw8G_k7PzB9sa(hRlWNcdyvp;3CQBINr1BeoJR8Jj~1#z zAY=T2#o1}2OXrP^4e;{Vm8XF_NEmrW(V(ol)(r1M&O979oeFL`UZ~Zg&BJoWkKXwV zOE7c~i#5W(~6)PDBX+eciWW5G&Uq)4ZS{ z$KF`o^qo3#0L;L-(i7mzg__#RuC49fBuZGyp~b&th!`Lkp)%&?#CSqrzy6&Xe0Cq#h>^D9@HcHt zWer|`j>L%5XLgL7apUEWYEeLLErF?4L#!vMu9+y>RB)BT-CpB(dYEEJSTOWKwvX>% zm{BjH7ekN5A5T5`)*=mj@Fpow$<4E)>cH zF<3npFwNZw2UcdJ>p*o%0amZI-cGrEM2kETtFMD`Ofcd}#&5J0bRdJl1n`82B{5|+ z_@UHoO>BS8-{KRt+IX8C93l)tugDO;;|3Lugm3mlVsWFGl_o7fIq;7p2VtP2^g@Gl zSpHhbzflJab!}$MWMnjHfiLzZR7wRPI=c^+V#jue1dT#TH*ovAXhQg6NlefbHZ2tP zZs3U(o1LnSWmkP_#;kkrluCv+?`ifjP92FAl+n0ZKf92&K3E>aa79o@4kl3{qhgsu zPtytZU zgI_%_oHS&Ejb@9qVhLcFH$<_1&qOqy5W=<6EkELcf*m{0U|u$J)XnvX@DWRpZAUA( z!zx?gGzPm;Qs&H66a1VsUL zDEH;@B;}VzB?tMCq%aqvEvp9*2ZWP88RV(w$}2`@sQBI%^SdhDPmd>y`Kdk@C2yOF zA^CI~7H%!`^5gp7E?aQAcK)~iaM9I`?Na#ZNh*Y4>+-F3Um**oz+F#Xk8=Z!Yv z;67_qKx#O3iw^fi9f6I3 zZ`#hbF_XUmha?!v6wP{xkHh!y~QWml!CQx6t;;GkH(Q6ZLaNd zwKp}T49iE??hM9~H#Y+dabNw-r`xs~!t&`qzx|V`{+}4$bIbE_Nz05)_wgze(_2KK+VWeF`(yEbs>q|{N@Ey^{2}U5b9KCeB zOtWn1fE~M)jy67li)(MFo^}=^2m2vkF5px8SM;sKozp~#4mIAPP~3IAX05$-UF;bX zPD|^3Yn`!PD)Pc|M>(PVBIqs-JI{M=Vk+s@oqLLg!Ukiv#>8X4BwyDd`=gwvM561F zWg(bo)qmURu$JwpWcj9|KePiC)3_*6yex{y>Wf0VlIVqYnpNq23xw|}l6tXb`|k0c zT&+|3r_en7=S{84P%-f$@5v9jTrIoLOIZv}BjwDctXJb#`3mIPSDRla} zsrc`d%*2YevHL=}09!SCyaWeyGwKd&V_I2^_4P*-;yq7nIM7E+d*t?)tyv6fjWw

Z*v_EOJ{1=|jJ^PFXwWorEpr?^!#2T184e zCCxoG#RG!3jbTEx2E5DCw4fyYhePkz)K+DoH=(kzSyeHJsrvNQ@a;$JkbXQ*7jscG z_CrBXH^z8~L$}yPoaR&HLn#2BIgmLdBKb#c#D4hGwR8GRg*oPO$hrRWIYUQffu}{) zWLS##cM1XJ-z2*n=n9_biB*!Q8t*#b#*IQ`q>+pd^(5${EcuWgs@E6yGHxsocaa)mZo=u8?;9ncg&@rqOYq}ekG(JKPPc2s~?khvFDnI$1*Df4{3!G~|FDRVt6%!?1 z|1?7VD0DGv*q7gXc7?)w;Q7W%wn}NAee3i`T%7w%HNPpF1Uf}h5>UHC`5ebg=2o)C z)r_MClnIal-^l__S}?cNGx;17(mGTtDL)n+X4Gwqt*gf;PZ-q}H)I9vOQU!sh)zRy zc8Ugou_XotCO>Lh-msCNV2E0b%EgDL>Z|yTj!V7~SuMZ;2J4PC_; z6Oq3||3i9cI7*O-o|Q`Tg`KEO5q|MqnZC)DLwRSrQ#wziWEuqyngJZNFz0kjibc|8 z*EBwDRCByCNSe+|Up_9sHY{c8zzLUKUY;*HXO`Q_J9XY>dj2f~fFGBcl$_IG+`>by z7yV_@K5xmubhs$B0ynrP-$Qmd?|bH#`VWns8&Bd!VJgEln_ISFYO88m5K+QTW%sQE zGfod~LJs_5NJ0L%luSf20=Is6Y1y7-_>QqL52b4Pph9Ro(t>4Egpo<#PVz{z>Ye`* zIJO=9^BZ)Tg|J1TNc|NJ}$J&4Ugu(bzhh5EuQQc}*H!x&-woz3> zWA9KgvDIBvB>yu(?*4kvApcK$T*Zg%+?Z7zZ5XtM_jo?EKY9e&tuCY3o@^7x8Kj}{ zM>?5`D)iw1w8dbH->$*1JryC&DS|fPWDQR>cDPtQ5C#*EQxU z)38IGwn-lFK(^<|mSX`Ba|60$CWZ$iwx&Wk-3F>5MHRguReg|_hb$jSrq_vFyKh@> z!QEp&xf)&n4;yx&HyyS84C8dEBZ|kB`|RZM!oE_4t?LJAK&#Jy7Dubgt_~AvHaVV7 zK7(?e>%P5L(Vy)+uq$>Pk=XMnz}oFH^msR1oC?Q6l0;QTxtG9Y{_;JS2(9%8za5qvx{uEuMX*Ot+|i!r)E{$I}Hd$+3TJ z;FPvS{0P+Xt=)XPLwmB=UJffA*q{^7#mB=5+X{o~L>~#TtbNF?1&~XXR;lEjW-L>9 zo(xsc@zS$aFhpAMI6TW*iF+Wn79AS~hEgd^(2V@@(aS3st{vGbKAZ25cX0Rh4`8urG0TiWC!ho$9W5m_R?KY|PQZwg1=jlSYH7{0M=MgH`iQ0~1*Qdaf^Nim6_=cF$~WlwAQJP|SIADfK+udCKei;)y-tr1HS83t(-d7PZu{RR2yp8$2)2pt< zxl#C;?410S7mo41K{f?~a5&Z>d{NKh7&i8C8JvH%@rlLPe*^S zVh5X5@hRt!=lN(`*&|k#&qE5Fl(`8Jo4GO5zGN(^_%sa+!)|K?9$MsBV5aX#7Rj0!rhQ20^G=~1Th)o`b0%^o?q7@oTLVOsI4>!(M zU$2J(qWEbXYjaDfLYF%=j8_rF8TV1EXXa+3kV}Wj&^riCf(iHX`SMYgrP<2ikU4#O0&`WdiGMl{ZMpPal~ocqi#vPky}82 zUlb$Bs&eLRq!lCHWFQ7$?(##&Ab<%}P4(#S812CvX>hlWCE{OKaJN7^I}8(?Qwxe% z+ueEI!0BbFC1oG*C@%0mM`dA0L^SZ3i#-NlM z%(t{urkzrE*$c@d2Wog(01UW%$$|jdTgqxPmV;HN*GVh4-X$qUxzgO~W@ejkXA2E# z^XO(<@jU`)dI#d>bK0C=7Pbxw-E6h?wTu zugmP_W^ekL$iggkYU|nXkwloN1+3qr&#(pu&pVJ)m(Rbyub5P386d}US95Wt;O3;u zO#k)R@?%}lmWcNzb2i(@#-#1mG2hy9kCivJxj>qXj{H+re@L5tfb@b0hZzUt8*ltT z4*9{nFlQn;a|<^b98sxHu$M8_ymh;~|C2bVDMrN24F#>j+Dk-dw9S%R!V2G`{WYXo z^aiBz(@PtyhQX9cFrH(T0T!s;wq1RXzi(|5yCcnAr+%=D{+KDy&;Ws%4^ry4CK2xu z=5Ce*db`YnHnx9x1&?kaGd({VR7uSgkfrOjmdd23V$t?4@)3)gu?}h=y5Uo2lnvx6 zmp<~FVRSr&*wdOw{EV^Im}`{D4;AevI6Yx8kx37;+(ywW1(nnlwcj8+sX_`^r6|4e z#iB)y4mTp~LNq@Vgb$0Vo{y%-KXj^LonbL#6ig2lXJ z4OK-u%-T)6$I{Ws*LFiVJEX0k(LDb7A1-jpM@gQ06q_AXU9N?*6DAqcJ!SX1emH*^ zm|ZfdUwU}Y*UX}vRM@l1Z^(HCFTYiAx*aNOGG^COxuC-VQd>IzThD7z*?4yI6V)-i@ea0ELF z#B(E1odX~pZu}eXsFYUUOnme$eHFWG$DcCAm>+Cab4TY>n#kt|NMpF1P8l{g_XZLh z6%jNb{J^Nm;z4fbX1FsgN@1OW2aVrz{hZLpmVr>VW+ye@M*8a5q8~4T*3G zm9Ft~6--lFgVBxE>j6PU+Y_yo8OC558~QX5j?d4%tEP;ehp|nnj;(i~QoWfestIL= zc8>JpFLl%CF3%UGj{1%KXb3bBA69%Z5r1=i_(zUO3Vz|4=XreLw2t;@@7*|j_Hd6) zXDC%dZ_+ds`7zERdL2d1%lk!Wz0G^P*lEy&I?`B4nW7W+;dkkoVNV8*URlM&4~S|D zsx|myYP6(>U9`q_c*H1=>Nj1ik_qIPp*GVU;n+EfblRjuR$&!tKVEkK&|15+ zW1t3=T$^H#nrQOX_Rg7m+$k^olO?bmei3+KLIA(1o z%092FM<&KGp&{I*lo;g27lpoi-76Htl#V0UA#Nck+H3Khi!fJ7;v@k!=5bSKILHl1 z(SdJB7z2VlS$GGm4gp}+ZSS;n5s>ChT?|xQc0rx@s=cW5h+ob-H&4ZRxTY4l-=yNY zS`Nd2&J9)7^}T%1-OC}w&T;A1huRV0EiHoo=dfH$@lUi&$)3ihT1j>l1@3dL!#wH1 zGOi7^nRQlEE09BwJ(V5QGqYn)*5Gms0yr|Y_l!^NXu>&KzFO1=ChIN&q}tE=uQnIs z7)G?Ur<|>{$*fXxY2y4pqrF{!2uQFUN-~vBs`+*G)LV-#1o!s&t?%s<37kEC2}42~ zskZ&6%EmAXg&TK6R9n~YG?lzbS(-vdW{fl??}mSC+0`gzP3`lX=bxKw&L4G{r7an6 zHa`EsiPmaiM_OnSC9-jv2?IvE(BKx~=?RQUqFiZJah0mm#K9C^Cl~#JF;yIukDg4A z(SnFoW6BpbRN?V+oDI;qTf`*%sEmazK&~BwOzE6X#aIZs^!+SskC0%7^RO&q7^cQ` zJ_Aq9nkZ?+&6Vl~3LJFeDEt-rYUYUBxDCw3>R_cwF>i9$S z`JK=FQM zOG`JzqmV{|4W^q*41z-2|r6Wh4#~;?M(i28Z~-zOsm)421JH} zu<_>O_1n#G&MBSpM9jRFp>+wKg8(0t^W7^c7J8M+6=v7UrI^SOl~V@9sWwyYLkI<0 zMIK{ZKikxsW4i3Hmbzb`@AQ~w{Mwp4Pr+AAI11L9GWlLX+Ue9<$izN|FZOfbIu8oc8F*`phNiE!7wnqlGv3@E3M;(p3sUG3hU0Y@707Msilxk2 z9X!guND@()d+a21us%3>_bmVm8;=xGM8FY$rd@Meo0C8+gPxHp#k7&RpRp3AhUBI! z0!w%9X2NWY3M7+Rzaa`(NMX8=u91aL)yqdGd!6Hww=0FS+d*FCBs9exfC9co4S2BV zfH$1t8|(_73mW><>}Hb`0^_G;GCM?Owy_Z8b3A(*Dkuhe!o6?0_P(kFoPE?I2b@M{ zvuV@eO92^IT4pjw`vkKJwB?D8u44#)iJx8}BLfC=qT>&Eh(KZ)d|vBQea%E$=J{jK z~(gm>Cd!d|xD8y~pAyklDzC&$U_R_P|So+9{a!BKxaKs~9Wo!Jlbl zqrI*l0mc7pjbBdQLaI{SmhT(q{N*WmGN*F3+!%A50M(~mJ-#fgMgo`B=3z7P^{Xa&yw>K( z0+o8addqRvPLTGL&p4+GsDT?Km5_Za93FVLH%U+HyQX=QvoA-ErS^S{e25%yg7nr~ zfw4nR_jCDp52Qncojur_Ur0YoFQ%T7r4sN~I|9X!fd3VT7qyggqg}^#k=>(^VHSZ0 z5)#SNWgNf}aNEZw{!l>|FK`*Hs;Bc&A;_yWcokt0WF^q3+G40IZEfFhk(djbX5*OBA8&+|9+nf`E0o^_B{>~OaSTU@8 zzjE1UYtJpp~5B`1qmq;9$Ccu(rI>$8O8f_j!NYM%m$HZSQ)j7Pyg@Ol3iA z;|ab94=+Gnbnmyr1&W(V_&FKraY_rIx1jSlU(y@!Xt&^5Jcdo~HH2GW+IP&QC#5rq zRV|kj^SSOcs-Fn4!T)wx-ty-Abi&7R870_RLncM#L%)0J89 zCr~EG@_BT~sEVO#kUrm_{<2!z)82j?_{QKS>14Le%Sn}Fm*~FVDM@+DmdW=>JgM|1 z`=S)yLOapA@eEx?7@g5SjlgC6lT>E#JK98Loq(ay3y7wKL;ZY8iM*@8B8-8QP&- z4sP~CL~5Lf`#QbE?R_7jMEN=LzBYby=n>|ayDv{N;4{!(rdE`=8!6LwocHEU&zo&% z2BgiqVj92hxOg@h7{0A^M?oneY81Kgv7u8B33$ zv4L4?PERJ#CY4M6O=gu{6X}`NEQ%yqdV1U0OJPH{feb%h7hX>7l0=_`1LF?T^yTjF zq3*1tyGfLZxD;w{09TF3@Z)yu$Ai&LUJp=uhl zcsD93WwiE0A};pFoiGNO{7AZq!zM?`i5>ryy;ujzx$|;H6L!7)rlf0=?mS(TJ8kUE z&Ago5Lh9Nqg=J!*BYuy4&F9DZQ;b;a>bNRvu;jVrpRB~2d+!7QPGW-t@$%*C>M<5g zn&F`Z;fvGMtaF-=c}2$p0SD(^`2{6&Y-Z0=SvU~+I_5*RLfeF876`STU@Xv@L%`GIej)2!eWT4AxNlJS z1A*&$lgh;Abf{Pa`!{}<(>OLpmxo7#)xzt+l}eN>x4Y&^)Eyc)E;LN1OTU*C|KLmA z+iby~hNx?m%zq0rFogb*gc_1DOFH)hviN-VVKu%7`R`z&IUHndn3*#iob217zZT=) zLQ@LK|G0ZXS;{C_2q&~lY_~QdC8hH$S0Hml?nB#aR|W2u*NIlum-9A--57+2*MMql z>1Ma>^WD+B?D(HH>0ZIS3#Yq-b;rx5S}ldm54*J4V0FpWP-uF_c^?u<0VvGw6!p^8 z^Pr;d@UVU|R3Rd}%I@%Z?_TOggeAh(xQILXKN-*6$L?e% zx>vUQtCU3GJQuJuvqjiAOc&}j+fL=%4gFHG@f-RZ^Jb0y_fh?rKATeL;&&e~k=hTO z&wVMj36xG{R7d-SR5|DNi^K7O9q<~mL)kPFl7d0i)xrmZ@6-mXy1V@;4ojPCz89Fl zntix4xpWQ%qj552|Ij`o8XC=IXmCvfeS%C&IVlf*(|X?Gqr)kL>mB{)sB|CcGy98I zlH%Fepr1_OLDa^XWFs_mx*E&RG!^i>t{@LuZs_fvJLr@87*r|YtWa~*_Cb+}6F11JdB+H4Jhf_vfz z=r)n+`tl!+ZXoWrboSeCPa1i$@~wCwhgUnEK{%i9+cLeqc2Tal#dh)RYg_Z-vMVbp z2VY=Urm#0nho>N zCv6ihorWW*_wmneLURM|2@n5Wa>W`23;i#}ybtor9Dib=??+qoi05j8|B;Vn)jLoF zuCVb$VgCqu(dCFxQr)m69Rd;e9}FPyAbyfZb!7a>E?P^XqjQ<*Do3Q9aL|@9mrE{F zR!Xz3TQg1X=X?uvf0rrvwDup+PbF1+$9)FnCRmK1JHdjRja^-Xq-0Q_)__c=Yq0BLeL0&>_>9~j~)#U_rhf(RoKSe> zC>_{7R5~>DZlZL9iLEJzDjfdg2oLA&bC2&h&4mPUrIT-hs8^uQB6FIiedwpz?+ckW zT9^xJ@8G?c=#lwc8<(fFcwAoP4M#qW?h=cB(y}sGQK~Q!W~3C$iiO6`JI`n@M%X5#kf+=x zbSMhl$@lEvspQK#dsQD(mPa{Om$uSoHNT>jxSp7_51STqE#fSrirkLigcBbT`L4WC zW`hV(wYf7Wk6)^t#!Wevx?$h)f7uC@thcf|6;CeJxa-3(J#co|7UlB?T5C2~wRB5dlFv;Hew5k)W$;{l#V?vS4 zW?=gVcWybO5ii0F@AHnfi;+a#BzW%37W8H~N&VG*qup(ISn!EY5q&M9YLrF6{5%+V=jUDDd~B1` zpC3BKxKt!U)t;VyFcEk@e^=T0fjVCiec+l)KcI2x%(UO3<|lKvIfZOj{4OElH3_2) zb^tI3tUksL?J_a{)PtrxjQgkhnru3Gl`~OEgq8?f*y$hhP|iJJ=J)nCEDh0eE&fmjP+7tLNT#WV2RS`PZvG0e%|L3FpD#5#82Ans za9JGpu2$?a4i+R8AMipQ0JzL8FW=3LW^TyB$KL1(i0O;1#|e|jC3XSN2RJ;$j~`=g zyq!LN9NIX%S*F^k&w6rarWS-XD}Ga+IfKvH@As#pdueG<3u}nEIzN<_?iB=jV_?Bwqm^CQsP^ z0)ZFfYpR8@y8P>@(RsSJ7=FmUx?htj{m2r{5M)q_@9x%|I34=ckp{ie$yv+xMzmIm_Z} z-jakbC|MqqI5$Q?V;b~m;2fIv_SVd>(LQI~i>T8_7?u?VVZJpsN5jE=G9q6vWVJH^ zAtYTCT*5(!oU&vTs(4H3R4Bj1Ds@U6GkUe})Gs54W;)NNdyv)ZJ~%~cf)EsX%k|7z zSF9=c`eJHoz}Lx*vgEH%xozWdDWCkATPPJ3zU|V3*CL*zaB;~EA1}0;wSDXAStPb0 z*z%}U34_t4qcG%v?TTwfG`nVAp+P}~@lTcY+Au0jvf;u4o{wD_jWBh+EF5HRfKO`}B}s$V4y!Dy3Ip^q8$m<>4w`7n5u~ z)i~s?1&_#nM?5dQPDA!WbAn zTohr#QK?fL*YeGQu3QvE8_ib79pY=OPvz$J7RWrKtXu`;)={+~CjgwlP&*waS zCH&|I^O96Dzd37Cu1L0f7N#lvK~^NcWgOBfdz{Cy9#1G6^?p$Pl}q0O^OO)L3w)ie zqmxEi-&2=AF}%N!4992YEoxOow|n~U0q@x$x^8}BRaq&K){2Ie7}}P`Tpj*EX63N) zXKzSs-*)ke&HJWN%!!vN^yNP9aXJYY>obPMDGh`ottLQ3{#KMDgmH@8(=c#SzJ5~( zXnmwOs*kNb)8fqf3o@*T$v3mfQpnvw$xD}jYD3J7@oL~=6n2LT7Q z(wrcbh&aQAhA!*)Uo{#Uqy<_Ly<4l9UmeB+nnKaOaViTajmX_6g2)_h6kH*Y+L?($ zH~E{5l7%?n*XS{uy8|hnh)AOQ=_M>SrZ%t}%9IfsuF9O=$F=t+dpOxVegovJ>v|aa zg-9p9TjmodLMS3|$z)gT_+SQhs5Qy`74F{XHkt@MgP2P*-0FD0FV23hN@A1OT#7=L z`3XCt%4mf1*Vk9A+X4;0!Ad#vL1vxS;5zJInnAz#!nXmOQmy{e&9D7`!7<|B^X zsw%Q<_Z^3{&5vi1(W)*uov`zy^W@ur+KUtnT#~!BsJ7q*-%2Ij0owm_F+^JQK zK0<7eVu+!93k4KvoG(|0I>AQQ2B`-PC>LP_ZaZ zEZ+?XQlNU-RIfQ>ZKHU3QIoM^h@TZ%i#PJAM-ZQuxFi=^Hac!;At52X*Lri&RN!U0 z?g#{L1dj}n^TGuMX9pyG_uxAmr)kBMGRd$DKj}S10z8w@Qgj93Wot@>8 zK&oy2SfHW->gxSl4+n832QNnP*^w<`Q3%79w4GgsGBRNqa=C*vv;*1TnwDhrp$2GN zd5^&r=}IgL$*icxc@s%_uI_}eEY0`SNEvv;cxOSrur@ROVz_-%Q>bdRaYjU`&~{as zgs(4HEZM+=Co$;}FlrHQDG+mSo95V$Gim3zZALm;Rz^dU3zl0pUEY<$D@&1EliJ$; zA=!_i+PxuPI#Pu(Qo}ZSgbMUn4Hj;vyqZwKXkMIZi}v_F4a!oqR0O!z3e6@o*`24- zWYuFIk>5(}3HB26m`c`1D{gkHTM);qz(1H2f|6g7^IHdhLLGO9rK;b!nwS%iPAkyh z0kROj%4h{Guij+SJw0DIyxb%mwrH+H3e1-+>b|U$D&z@WifP$cMNandxGoPQjbsXa_)br{>D& zcJ4)4L1mQ&Q7V7OIW*1(o6#qv5wzTP`EKULa=sG8H>4Xb8k_L$5NgCzX08UqQuwld zk~hr(9WlEI_yGibY^F>j36JBt_gRS?QbX0V+DS(z-K!i}pzZmRtV!Qqo<*>ue`O|? z==K*f>cAB(MdmOlVkoZ*@8$SBJCrEHxV*b5dT1a5VBi19dN3B%fdva?_DL& z>JvR#NoK@PI3FU6oI0(`=w0R5mV;u8E(=v~wj0=^N(!*( z5ztQi=kOmc@n2Da{~msti{E3sHk1qO`zmiw3q?y5*F0= z@dxKBNp{;?6}6mh18C&-w7Ylv-{$>D7v4}m9Pn=B#1G5GPUsGbwQo;Lp<+RP{{0iG` zqf*VCI?BD$+Ma%FV#53<7hoHo)X*K;#PkEp6XG+1bNgOe|HHlhO|JgyU-a|+y)Py| zOU?ssKH~t+j$Zx?;KyEHIH3x(cCQXieI>>IEL5Bbza};%YCYYOr>-67z4bbw%5JK1 z%*^3LFI4y)DrYerlIJxs*bEwHs9J`NyF2euwTaF-u_)W0a^H@d0%=9pP!WGy^KTD3 zx1O$@wA{+F13tOf;gu;+qrwbY6-+?-Wt0aVU#hhYxj>*iO-vIkt+V`+T-Sl zLHW>mTbq*N>er98GLa7G&nFN zJ8l9_HGCz6fcB1)O(q*d1BCZd7IVUi>2*Wf#1DJI{f}W*KXuqW{P#U>U+d4_t~V^~ zk8{gcT=%Qp?y`&tx6K%PU8GmP<{dffY4hCE^%b}1F~$M#Ta*sm2aVeGSaVs)GtzK? zg(Z;%3Q9fN8VEUZyRYKxL0lYDB(bT#rzF{Ts!If!2R(0b2_9^^`Y4DJ?KcKIWSCp4an} zL^NeqC!G~fobU16t@&CJhg3L;JN?#T0UN`O4H$)Vrv-Yetb;(bhC(d@t0CEOET)&F9=*4x1U0sXre4xcJIoQrW|VI`=YM4VYG}XJao!-+Vlgyx@145fz2*kz+Z|G1OB4s;OQ7 z3Ax?ap7x&}4!|!?_=Q)wCG9JJr>Vn_6T%iguDTU}%=hoj`|Jsze{_q0D1?h#?7sLw4& zC$oDoexeuvL(}caY+LoUIP2Yh2zEahTdg^zOh=c&&p$eLPe{+t!V< zA)2!0Q1_n#=`w^jJTMI5$DP5br32hcN4S75S&onseSy}Tj}?A znn^RB(kqvgY|8QR0*B=`{$e=uT@Wg0iM7&ZivNm^2!+@^pIDq+Eb3XeOq8Lrg?}wtEI=buKT?aE=4A&CC<*r8kB5}hyj!(?(bJXe0CHv{g?3?mp z3uY7+c-{^**i`JzrlnNFO$hI>o9ZG-TT>``F?*;vlrPO-q=-w|Z4_Aibd%mEH>6FH zV>*2v$SFJFDz9p%s3AN!Ohp(H{tIDzYFFwNGyxj6_O3hPE-H#1zs;wEF zo!kBkH&_!=RP;yXO#$erqtu~t(KLmK_H|4d_Ky6%f-x+ z8HI>sm_W}!t=>mO$#!jHPDUuRk14X6QdxQ-%zXTHCvNKFCljrolT{jQt5d#4$ZD+( zX6wsWGW=?wS=3?{^ya5c*G-i+j;7Mk6PoUb#!9&DGPdZQ)gmKH(Oht|(eEDRwCqG} zTL^O*9}$%z5hCEAYZVieROE(m=v*SUwk#RF4Qpdyjhz2!o9E$JI5=qaiav^Q6j6qJ zsb|Ze`|#xCQ^Hi){!p{MgZ(l6=FYdC0#dP^cb5XgZbZq(z#zuP7){Z6w5W@ap;A%W z{SLnnK0(hNi=ZtG=Fg!@FrU}r`iOn{s0LMhUyWcRt|t0$bs0R1(6&pTWtvM%{m!IC z#P<_iPbR`JX2syKs+4IN2As?RRd_~X@fOlw{T^u|6T z#^&Vi8yg#6-(wR?)vFfq#zC7yF*b@twkzq|^#SGZf}V<5p`&SiJVZ=rqzt6rveWQ7 zr0Gg|h5wY}yc}d_lI`n0p%llzU}nQgxKTMPqi;cnQv-{eXjom3&n9-HK?s()Thz>^ z9m~9;9rw&?@N}!mQux~uHp>&zE2q%7DKL4_Xu^{iVU()KGa9f+{}hvh4(ZZts6*{g zzI~*2#feq1qHaD+9;C$T>f`N|wD<{0xcc#d$bBlH$1rPVG%D{fVnxAuuRr0FucJ?< z`*R|97^W_RK6=hS=c@|7FjkvSd5C)Y#HhN~lRqhqsJH7f&Om+bvPywfUK1aUxX3KG zwsvM3Q7(?7v~VS`*l-f)o-zi9B+;ga&L@utykdG7WHgW_QE$X5PSelk$wU<{C)>AR zZBw-I5Jd-Zfv~saZ7GQ=j*t_Z+B<#NaU!yQNlgS_Ylaa7$;J`rMF`izEe+Oy zJS09M!CSGxt)Q=?x+p7fLgIBD0hR<32O=rG+}+Na4*u1JpSafmU-yMVBZrY2Z|!ekjdKnok| z$oD4ll*5`U{Ew=mr!BF)Gip>lawCf=jkrolpM>lw6~mMx4g47lnz$rfXNQz61_s!t;6HR90bL1);s91Y~C(`mwV7A|1nN7o`3F)Yb zw)YUkH14Z3ZrU_yg0#z;*^NiFGpgdGa`fX|xO(#<82}BOAnPq)4wQ|QI$E7#Xnbw_ z$xFi=N=1X7m`Hy2=8D_zVu>a{EfsK*bcDsAPg}<~wji-`731VK3v#*>0@9*3@SJ{= z!F(roY?D@%H@MO5)nP5F$+-|b-&{+w!~;jK_n^LXphT6CMj~HHx3nv5Kf#v<6T(t& z({iS6FejXAEnz&+D4xo4zH_ED;YXE0{c(HR5>sB|a-mXLw?%A7^u3eR*Dq-+Nm16RQRa~Tg6^huAiszYH8=R-kf+amS z9CK$Ka{a+QpGK{`YMDwJb%KwF7~w&@uu5XBFsw9;$mg^BqI2K9NqUK^uhZp&*y1+J zrv3h~QCg0w zUil{HF{zB&8PeH!8$6y&Qb>MgQ!)F|Y?QFt=)>REH;ulQ5pXK}HT`QBWOIE|aqbN$Ow!Ac~idWEfvn@thLDb`LI%(b7Z( zi}XG#pOQnyDIhLu+eGz8W9rG1w?`W(80F9@@g2;btwh&!Dd(a}CG;g#I{I}cwp9(j zE^t%_y>wbHR5OUe%QpDfNS^?)I>*=cWqmToO2qq$=aEQ>>_)EmLC7 z)xcw_ks$=aGLfumwc8lRXY4cIMQ3Yh6})s{K=r6rZvT>4^a$+N?hyi`LuQDWSle^i zhebliE@mAywG*I9{fwmg>06bHJ0G0fR837eSXfB&^aZk%2iQs_e>to>!dwQc(-X}} za+43MUh&aG9dH0C;YsPRr^qv$ko1;outflS!5*5L*osv~+5+0UbQAB}qnFu*#n=)~ zR)|+oD(VvV7CG+U8_Cm3=-#r!cG`HAy`LjF^i13@B^xB0v<6ie%ZevxDjVLZ?BjKj z9*tBopxu18`Nd{w2o)9e;dY1wGEHfr(O9>;WQ5>kUi#t7H{yg`8^ft)q|7nacE2bTbto@H z(an^sk}R+I1iSHY3PODHNO%~+9yPkLH2B#zM&t?2R&S2*$AAW%nC29->)y5jO<5-C6An!;+z016 z6{;h?_ii`ijp6ckD#p=k1aK!}U~pkn`~J$pNUlJRu9Am^I@|~BOOm>)L4B7vhHZ-T zywPPPH&>HooS{>6X->8}>Cj0?x@v+ok2 z=~V}DYukTfLI1M3xs>eRNW7z4h4(i-{7+A7rso=6_niL|pNi_XpGP`7VsCQP2m#%X z6n-lyesylH5x=&Um`H(!uPJB%FZ~pq!^{$uDhgbg} xgU@#!=szXN-O>X9x3|ZJL+seC5AJ5~K0rFUVTAHfIpoezQC3x^T{{V-Va7q9G literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/02-validation.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/02-validation.png new file mode 100644 index 0000000000000000000000000000000000000000..37ac471cf8641f767519305ca1f023c6c40bbe62 GIT binary patch literal 60249 zcmd42Wl&u~vo=aXaEIXT!QCyv-CcvbyN3|mA-Dy1cip&4aA)K0&W6qY$a}t1_f~yX z_t(93&%dr!YkIAo?w;v+`k4r2MJW_S0z@b%C=?lKaaAZNXig}ok9P1M-=7q=JEKBD zp+m`te^d9$I@^HrBisk`z75l6r*JXqB$|(_ZN^#(Ci2ou{eqIoRQ?Eq*!VTCr{#CE zpPsJl%jwpdsxG1%>syHGmqK*ik1}NO17^I6I|J9zE&Fsj31*`Ni~PrTfTXhl53^xK zJLSGZF#EUm=XIIK^+VxlS6Z4lTG98vfPx|u{0{#g;TH=0)PICN_)nJq5sW|mIC~wK$j%rh5jeNQ=(^m_$U0r`2R}HuLxnZfUKZ2=&b+pyAkla(&^uyu2e+ zNE;9Cq!PFIkNQRlgsIOedyW?_RdiR}cSvsmyxfMuX?W-9f13R1K?8W{wI5#r{EiQ7d6D6>2qd7x49BgiFn%%!{1m@Y?PfsM={r=V% zUE78Gt@+IManpI2=c2WXJvrt-Lxq))()n&*!1^SQJf3mfDA#rHjhx={eUBUJ{PhKz z?Hz`lP4ntYgz0401CbG5(CR?^7rkI%#=hLlKGx{#Mt(i0v2eh;iZKhpeo0SXR2Rs7r{$}_{qkK@qBr6jsF0?>;In%1#y8ERea>;C1 z4iD5n9I7F4GgW?q1DEv!2Pj%x!%O7Rs6JuLVOkK5`$&h{jDWzh+H5y)Dh8(~LCI}l zzyeu`GZ8ZUe0+a^V}e{P!jSX2vP7Itm%tk^!ReZJ-;Q1MD+C1*(>{P-mW;+RvhZX!>13cn4wG{?45`xQV!vfAYf#I2sx4%aYGjlB zu81`8R+CH$$Fp|ee{il@IPdti@*ck{DPBt{$N7i)*(0t8p6k-ftL^`+h$;QeUY~aA^}N=DjIh})v2ZK!ymU?^YL9Xrm(u} z{K1%Ab3rwqOsA zLpOx)L{)cqi^bY0N};pxt8C*tEDHD)nwI)5<0hAG$*1?Q<*S@Z5(@*1Cf}F3@9dK5 zLqpgrKNE`4Jp8XfmiP9W0~Qkk?CBw%@<6APqYH-$U&97ArwSK(O;El5A0?l^bURWSKT<+p|bc~m7j60P165$&a%YE?Gq+d&8sfA z7*A*vWt-rTwk0@%Ajb5hh{Ku#c@@1{8Dzl>&8)z*T1%xebgvWUTdvrIjDB;!q;;U| z9X?ib@M$Ta+CRP)1sT>+xWBZ*iJk`2r4;MfeBhfpJ+smFdG*_$Ui2ecu_I0){z+sQ z*LdV_Ls|?;8iK*LDJL zgxcruuz#sQ#zJx?c%?L=j=C2>)MItw@SJ8QYUD7vyK`we>Q*WTbpc>SiseapqGNOR zgTIfPt8;%%+xQHr0jI_}^=4|_-;d_s zHYmL$M4F#Z(b1{4 zYkb=I`bpQOzKV^)38dBeu4(8g3^!Sm@fVZnA5!+`4|FXpO1GN{Bhv=FXMVB z;x`8Wh}O@K+~&f<<*v1Ca?JbW4;!@oW*XPg{8c)z^0)d?I7Z2zwZv-0MTdT4sH}wc zdtFHV_fktPyvm@<;t@wk7?skYGvQVjqvMu z8FRF+72#|s2hvz8 z*o4;3@p9i1?OF8)J!bH!$eNo7&f>9LYJPy7GNI@@Nw@7)R9-t^ZIz@CH3JBhU8M6?8ENC^%Cz zIZ81Ld8cG$35_pzcXKzQf4p9apq5LaY|p!WGLf>d`u3BfEWR^uo{%NtJBL5-9I$vF z-+scXTMP5JNYz}uPaZ>J3ptQg<^buwQwOLohVrOvTk(M@#^~58?Yh)i-L4-|+0kb?XUm^#@BK@+HXZXOi-XjFb)?3kFYfa0mF}$h0Gn3Se5w z+W=a5k>ku%Qo+?*5&ee*4T;DkVIf1z?77oi{C`iA)T_UE5^ste$9|xAP^ElYG`{r|>|Zr9M9NA*cT=NR>f<`7=O$f)q&tjJ*OO)RZbg=j zgen>t6Op5NW=1?qpi!|&8ayBk^`pYls)j$iRr47xa+DrP;Si7hZJqM8taHEcs==B} zpDv$6rz_t(QbSQoLP*u9jR?VFCZ&{>mZ)=5?ssuXVets#aC`36an865z*h)>lrU@W}WRR6>wHzQPnDP$q5G|Wk(_?d|=(UF;k28 zaS;*RyYA}~Wqx(%Db&#GUTdfa7OF{ct=*VKgvc7{sTm#pl$bJI5w0i(rl)1oT-Xs@ zOHd!sQD9^zP;D%-ITq@VopAZ`%HZQ8rql$2Dhu69^->e`a@gBz!Y5Z zVbVA7STJI_;9szr26~>uWd|Ml#@#hVSFPSH=nY>k+VQpXR9Q`eGP#`-d?#%19M*W) zWof-8put`bOqn6_C3S5N+WmJOA6TsyL2F0@K}+M^P4?-&e?XI_8Kc&GVF&YuiZh{H zJofOLpS|;w99*-=c?)zguvf-4nF=I*Dd#W-eX1_l zZk0WSuwgl%ZPN<5$yw_wj7fzoXS zeYN)Kbjy&+?9rEvuyr(u%y;CJ{^PccK=Stt=t&L=_$_%dav@{T+B3mhUav8@xC&{G zGsFiE9h_#^HaE89a^i8$g^uqdq^A!`#h!^r?YeMSrqqR(cskX>-yPwgh3y+JmAATlPpBJg!Inu6GLp5j6unGmXE>mw50q@OV`ptVb(;rK<1qVTvODX<2)zT-`9CVZDZxRIA=zqFKwMfj`a{)7xY}%X6 z^N^kY$(?HbuTcn57+D4*(`IBfxa3FoXzwOLu~vjU+fPPC{KKXk16XFtg zb3^_YLGKApLg6Kd@ellig4+I&!Sx>#{->gC|Ff{a|MPE*^QTpM#}aQ&8Rl*q3b0ip z^dr0dVCgj4CqfGWhKQSLv zZt_>Q%=4gJfC|e%;yfRreoPyDdIv_MqWgCZAMYpiy21Cz=7^-bE*MeRK@AkbORcQ( ztujBuulT_v9l#a7`Ik3H3wSQ@(t|I{>aDw{%g5bL0#CPxczn0+V!ipS*HL4L=5u1& zXEy3Lc#=K}jMgtM(V(cSbhcSm!R4oxB~I#c4yjE3cO=ELKh4TepG$$^Q8P_lRJW!T5sAgi+u^WcFM9L z9yN%iSccb+g>NQRiorzat|vc`R!B7-h<(R-u9-{@v9ph|Lqk+0Zsbt%a=R_MAt}!2L(fOr-Z&q0puEQA|NH_KBMnF5)ZISJ5!H&zzbd)#(!j-wW;R|WOM!pUy$Wk08bnKLruz-dJ!@xZ2 zGlvn>2SU1+41JUPjgty5lawA*KV-=!%VrO%@Yc6*cU^740sQid4U)Tv0BC?RO;k4z#0a6yAV z5aux3Ha3XQ4fx;J?I>#%hp62fZy;zi*jZj?q)s^3(QLq~F8aNyME?~QIaK-!pQ{i6 zn6_!UdQPC38>usuDpJ+4KCX9l)j@$X5^l2$3`|-jR7>$5$70~w|Ld8vqLk&g9de-7 zq^YE{A60`*Eg$=Py;zCV|1ger00_Q1P`JjmD|NSeR14b_vg5TCPmpzf0L}W6jLKkB z%yk=}3C&}j0kP7v-F7`0F4xJ@SGD{r&jI&BE6ET)2DQ2$_AYg4dl#f4POo$QB%Vhv zeHOq9@>cgMP0d)l*}Ki&C7|z)(}5aG?By3F+j~d=&}p|KQ>$Q+wp(?3Y-WgfrT})|F|xudZ8^rQ`MZLwprV5aZje zHWG)d%t+Eet^ia*F*iuPPYJ{2Hc*yjF~VOw*AIT^(En8v$*}@0k69Iu}Q$q z+c7zrcB%@HH}0}^pq2rrwduY~;gQ&dM=Ed`LAw5Q{f3je7WJM}GmNrMn(f7cLWYCw z(IIPgi+OoLqrLbpYaw-dxrT38WiRum8Z7>h_&p<@-{VJ$+!ds)9{uGfBDrbZ$a4`O ze@)|PR&}~cv6{^WTQq@P0Tu^lt-ABj?FX<>2|=Q&*31V|27${q;?w$#;-s~Tx2Ibr z>T>I#aL0*os-+PsBwvuF)YfrCnH)o^8tqm*)`V>hL8u2{v%kG=PnT1RF>gmepxB{o zEi%4#Pl-pQ>G-v6g@f}{^`IUbAE7)-m@(LfkDrg#j=*)Jl`5v+Z1KUC0M`Au{)=Mx zkb`gkHSn!d?RBzg8bCm5jmNKX`p{aI_-9(nN$Of2rK$#eaO9YaA^dnc&lfi1`t^J{ zdZ1Cq<1BPxWvoyiNTeI-ZwXNY-2T341`bVqcG*52b3CUXjrxYvYq>i2bihJv4fyf` z;{R~Mzcwq+TSi7~kihy)RP|!jwqAG@`15~HaC4(ex>b&ndcH0z<;N+M^u;boJiu|# z)7H2x>6bD-mvWU|=G409va+EZH`9BvOfDq{i0&rueYXYVCaERrzLy}zsCmmBQ--^Z!<#9px^xn-@t0KP^+Vn}_#U63VB(8Qb@qq&Il zR$#8N@QtRq4O+4qQRJuvYI#+u-8lz@!Okb|r087i9a%jKY7+4y^A7EaqNAI59iosa^I7OYb7z2rLSez9k@17VF-!+g>{TO7tH%A_pcXOzg*L3k^Ln2-Ooud&@oJvbJ-;BAlZ^2=t^&Yp^E@1g z{Rl`FtqQSn0I!L~o_eGf>iQUUw4qJ+D?p=`z$m?3&t?K>`br$-4t+(AY^=#)7?OE} z^^{Y3$zVUaCT|s6gv}BARLe+Pyk^+4lfU;(8OtU3d@EdL+pL<0HDPvH6RCWCd?cl$ z%0d;1hLI2v;eQ^To{HfbFC9(TZQJZKPLiuXX#mx=@A~b;6vFFboBL@rzsWQs8<{Nj z=5x_HucEKYj7swT;odHP2IVQ8cfxCG&LpPGy3TY(9{pN*Q6lyNW`L3o=^Fs0!+Hj9 zn#z8K({Znig_iAM@wo#sf_-t%((D6;@&TPx^;K^nz(0D9<8-4DL`JP^wTHvGB->Pt)<+X9{|`-po01>oL=v zkE+2tIe`Y5A)%Z8Cx4M-x0QHgL>)ucRs+nCwFV8*T}I9GdsX_W4#KZ@=N0h4EvQ21zwhUgsZmnP{@bcH%v9Dn9bl6tN-o4 zZI^UD^=UPZ&ucYF#~O`XA{lE$X}=ThmlsjW8ZM}sTVI=_zoOCF&XEv9icc@~sS8s4 z&cV;a0qb)P@!q1y@=R#>xT-P!D)so&HMkoU^K^0>p0ek)Xzty2uAa}J`7xAH*Guff zx)a0Ir_|ITIf|F5uoj1+Th>K2VBmTC^Gt}Al@2yj;QHJ~qiO{CB7n$eSE z*n{)qGheLw1R%&35|!(%_KC&xWbf6SA=gLcsb)#fXw~D6F>}mLBj7Q!EHNiGIAd8a zcZ%hYhr8b>QLPzzhV}Dk^qwto!h{y%L z`OS&e{pK8_i=}jKnc__h?*J)s^Aj{kGF4u;Zj(@Od47pQWQlNyLR>OYN6Y=ZG6};# zPyT$A0qrM5&ePar8JGaKI_W4pyy_P5)PtC`}X12)Ix;i(*-2a%SIDW{~~X=tp4tB$rk+tYFp zsO)5;4GlRdPsDMo@p#VjV97+x>+jrLjvO0gGRGL(g5bjQ)6z9%&&_PKDF1grU5EJj zEe=PjS~naWSbb7xb#gR1CgiNGK4^;rV%0 z0ROv((~qhA!;(!`x0j!flO!!i3bs&vC4Aek&jT^Ie;Tc`IMF}MUZ~>Y+5XuTke&AB zz~M1%%orEm)Xeo|5s6~3S84Ht6(v2+e|J#mP!cRg8BVgmiDarWsQ{5-79j~Pz~lX(s{ z+$oy^^j<`Cn<0gDG>!}9WpP@_b%^3&QtN5YLMmaSLv6cq7EY$DCh-?Q?z&H;#^lNr zMtJLn7)lh6>5Sc5`X8sBQWIrhvM*LNgRYMZQ2ukO_{q_+pa}2Bn{iIWm@Kd>bPc7l&r0d#n5MuR1@`SEBVesh55U z6v#v#-EYYLoSv9fh`lll=>&dXCF}GW3ZKLo|Md)5eVw;YBJ8Y$6GP7Wu>H7d8SwW= z|A9U~^A@#xo!?_^5wL+1_$@s>L6y8-N5SE9r{0`HZERhL+n+5-q=TE5J|)lwPUiHg zO+Kcc@CnP$m={Wlqjh8{$tiY90d{w>nWnWDRGaluR@JQR+x|cUJ$}0ChsK9%`-28e z&LWA-Nx@W++t#vp@K00Gk%QrJhv$vS#{+#qv{6ji`Wl&(&dpU$bybpS8dSYWhXG4C z3PBzLy|JAzJl>WUY)fDrPK6qyv*g4LlwiIZkVRE>GQ3qTk=o?FcAt^;S7;LJ&f(F6 z+N+;`EgWuSzI?MBbm7y1INh`Pu&`2{-jZnNN@a27yqfRQ0?rhCSzru4OU1kUx-5!h za6x|>>o}rE&qfeyFq@I-lVHN~HW+BD%wF1=&85cJP?t@Eg%`xlZ4|-dO-2*2^@Kgh zXD+tGfz{%?1QuTjlo`C!g}$>fjRg-#qR{kRiXn~JFN1HD9_wxcuJx@?&brEeU84ou z9MKxw0js-`pUa;v13ab+N04WFR}{vz8U)_1j)Ig3D?NCKr^^;D&_6_e^DLiZ4!mlCl@VGJMJ;lw-3gPZEveN^pmD6Vr|sc<+Qg*@aDE(zgKuouYGCpD~t zeNi)yKH)9sw)o?*$SG(qZ(64Uu#@hsuAobvVpnp;9QairQxCBu!AqvBS?d8eYFq+b znY5!*t(yFI7vuiLJ+Up1$So+|I%Vk<$)Q3J;{2#X5<d(B{RubdKv_c9y;e2leEIsUsxl7@^|FV%d)K{NYYvpi|I6932l5-M`y+b2ri@!k zI=-Qy55yj6LM0?j!q|A|Ug%5Z(l6U_7ac7eSIWhCFD_^ij;lA1B}vb?23d^v34!(+ zLheUKXx$G|rdKQKe2>EDN|RO@vxmqLHFVFTJi9F2Jy4^eO(GIfMxZy_Kuuptjl{G2 zae&?zwO<5yK0&B}uvK>sCUCy*g3Y-~hngdO_BlT3HU6WY=TWLifT`;r&(DUMcTsRh ztWz9S)A%NPkc(JL?mRi?bUn714g5SV_R*D`(J2#OUk_5?ZC{CHjI=&FU|Wl4y*)Z| zkg`SCpXn`342@~S+TwPn!IVeH+1{h`Y^Y?(Cm>*}+wB$)alI;?@;9Siz;r!y&Bm=# zM@+i%mnejp&r{4^X1AV(B3EIjv8XyLY-KyIFE##Dma9x9NuaE{0m7VaV|T%%keh&~ zfo0Ob*D?299*bGem_PH%&tiAP|1$M?OhtTSh?uPpoWvbs_ zVdvC5?`aiK;M9jG*SOcIH5d+9IwFL{;N~G9I6CbY0Hiy`HBiiks6CW;RqS^ z2mqvMf*kg3J&iH2?v1DJUhQ(Ru(fn?qF*F0gE4(4F|8?ZoN4;cjmGS3=3j=T0JpSm zz1s{8+-ehk!$teqaz~=qYo+53F4A^d|MBw}-)`scEij{U;x`eJsum`0D(%)U^~{<2 z+MuYSQ`r(b9FnBgeVrv=5#Fm^`=AakNJcV^=zxUD+;KR@fA9G>YZ(>XHIPZ8z}%r| z6uw29rq>-@5d|5Qjex^!1O)O7E+F{vp&a_9rmgse&tvehmC&Kkt~+<&~wB~Cl0(>yZq<&vK;XYg?c%bIiYm<;Xde3JX= zj4ix|zenq;+LP`i_eUC?Ru- zcn=q-Yg#|h^?TP$c`_h6{J0#-ny?(shYnk7wu`?lP`5%AsYf_q?yFe354dY`?D}N= zK5>WN>wa>G1MM$u%IqhAs>~)5^^|=rne({gJDyo}kB~D$;1U|jv^nT%y&|<48%A#| zgg1`3?uX~Sp*`cC_UW>qM`iyppNFjf`2CE0ERpdQ*-Hq1j{Pbe<7xIXT1>d}@(qWJHNlNWi;>W)jGPneQ793yArI8Zwp|)J>TYK?C zuF$1Cw79srB5!xJDVU)pzT!+Cc%Jwj?4E#(0v<~)yPjBT!qP4=`;2Q0iS;l-nFEJ? z1UJ!yiyv&oWSTi-x1{C`2fGV-RQ35USKzhAl^>{Z(!m0KOGHDPPB`+#^?zbM*J4Z*R(|7kw`4dU3 zDJD)lr#D57HachPRZzw+h+c7Mx0ZG9w%x7(w0I$06_wS9n!;$9{LWxPtnAx$*17XX z@%M>(eEpQzx|iiu7CmedPg1dAL%?;9W{q-3kcPQ1+Z54R7Sha<%fDevYq?Aja4?%F z_|ARdpTE+1{DNUaub%7#OA#8+iZl@rSNv1oT&*7T`!}7Tx%+C z$XkI{sp&3vjX641Q(N_mATGDB0qXEbX?1~;Eh6JtUl;D>?gc<>Z3PxB66_1UlwHRcX$JLL=Jchp}TUAEg%A<%D zJUpXkBiII?2bMVtCkyAikB3&N5VA4*pKo~i_YY=|C7~sXu&iga|6JLC@wk4lC}4)h zCb6NiB;soylm@5eS-G(iO3~i<6?elj5qnF>V%Hx>2qoIgxs!L(>o9*8)q3yFL6PY* z$sQn^!ss3AdvusC%Hs$3MJy#TLVEDPW*yuYG87>WywNe~0u<9EmcHzKvQuoh^qd zR#740;aiu?Y5jq?1Y7>jju+@6UhjzgK2uPZk3p9l`^b&Rn{5Ap^+6BX+#E3pJLvml z;Zj;BMJh#dznW@WwMvrj%~XVJhl7T$)0$N1s?xE=dMaLAAtw z?M4*(^8;*XgLaTveCnT7$zw$es_dssOhscNP1f?;_F%D2P4}0wZU@89xwP?LTri6g z{3HzPRXnSclX8ZdqOT-}gyn7Ec(-o48oT6wuzlhYmmcZBvkku)w6U=R66S zK3u;ERJ^Yf`L!&+@a71=IlT4+mN-a3T8;WI9Z$t7p1gnEQEfy(ugnw+z}sEI-0zS3 zZ|r3HZ3SlBjl;@jQ1Bcy<-A>I>(7DGzdWB&=9$? zcV|4cjGkWJjn`iw6po=4#|6m5^M!nNIb*722>o&IFUr{q21q2qUmHO zbQNJd4O18PB^Yy9Yvb7}{AF#8{!Hs=I>8?koH<<9Dt4GA;WMSeW*CjKg;6e>$Jl6M ztDf$TYV>^wrc;-E?{dxS%xQ?i(*EU|Dn#OzGa-_3xe`{28$Us~K#J}^bS`xnkon{j zX1-coi`sayw>04VD{}9XeG=$rvx3KO(NP5E>1{kC61g5zHdbTIXN?%%?QMS$Sn!<im&8u~TCdWG1aGD)G_CvQ9}ac8QhqyRz9xno4?vO2&irqnn~&Vn3VPnOlpoU%!rX zkW}i-^vh90PPQgvSho&g3wKW3KL?|S{@*D+x-I{nLH&=X`1FZKu~7VsXn;Yspc?va zg2zGekwO%zC+i7JCF3KLyL8xumBS_?L-tM>Ta~!-qG+_DV9n}J+O3p+FECSMBB%9H zg??E<{is;mfw9EPB%It4mk<|!e_fj_007)2a2Jq5r@(mUvc=$(=y3e(-5q9k-fa6& z-?}gATrS%7ixB@ZZtH#bN(+Vu^jnk8TkBOFI0Qd@5~8B`If>1YW*26UM-J>vX$}B~ zo}H~%R#rwwGnT1GzC&H8(UPW?mI6ghP5V7T{#Msaeg_kmQVD%et_k?TqdIjLsn08k zjq|+b$dt^XBl9#+5UJ4>U;#?>rPDX{y9KsGuLYDJc)Zq<%~LE_s8ESH1YO>?wmdpNz&$kdVen zArDIu>GU}7JfiWxi|21I9nC`pO89OHz2qbGx&0Hso-O!z<}55;nS0o_oJ?U z=41-i``$ey70+RB66U2X6Q9V!l@;9UHp`r$|UBdpZ6zL=kVp-_}QA{jck$!P?Afs zUTX~fZVrrwhDMW*d)wN%WYl+Z4oke?{%r|3BP~Nn2i&E6bZ8bn)b~8@O-p!5$=IAZqp_KuF18C<7-DYQqnqQ|me zjKT-XMkD_IL4eX`ltEz6qvCoZFm)1BOv=tSZCZT~I7ZaW$(*EyPfR~yP^N0HCFOPG zHFeoZ-~G8Gt+YLk&DXnhXp>`IUtizR(edy7*r_SS6AE;upCNwmOrbF?rjm$BJ0^cx z-tDXVf{k3BgU~Ikbt|8gkg%|@5b_>>&dR+y78cy^=HO>Z$m;_@lwMbbI`8`PY|>l- zT$pTP2lDjEeMuG{prXRcjd6}!B*}jLhXVNj+KpMHXQU6gSOAtjp2*h#5w&QFEvbB{ zG?Y*YRy@3W7DO$oVU1F7Y=sS5K#<} zORX+bcD4`;;8j**;oE1D>K|Lkly~x448odnV73k7G^yZML!RJ}R&U`8mzF0Qiu%tV zpqRf7n(>lc;IgWdvqgVH?`DmgHWM}S_^6V2z^veDIfUhmNtzUNW+tvj8c?3yb<0~* z9To%C+GoF9dr_477TIl9%Gy|HW-T)+2YjCDe|aGOYD~5s%u&6a{5G^?+6Gn;6iDV2 z;PLx<&1HP&NXber8ZQV<#z}7(T8*x*A~PG-x6nmshutQw5~)W=PC-*NYUqe9@?v?B z27Rky9(IS{dLwkz(=wBa*Ys?RnHA!=G3nME-r<0bEVQ^Ja(8sfRuD@kL7i3)54%t~ zDvlAQN(ln*4dmuJhzdb)nBXD5&2x-WA&9nXAB>qOb|NEi`#CNc1C zX)mdCvec?!r*+dc1r7=_cyLQzf6iW>^Ut{*$loI^Nl|L9YZ;Xai*ClUf5`L|ML|>nU_bz-K|xNPWdH znve-%h7vdaJ`?ihARwi92|jab&@?5vrD*0=OxILztY)ViS_Iv2kT!P2x8B*tZRU_u zOeTD;ib2mf1`!pPuD#jVUI^2>f0R&a6X&!&^W{t^XjO8%S=K&?W9-7 zt}l3JU)nVKYI>fXu*plnYST7LI_l<#MLjgW^{s1wL!_;z1Dh^p!+ zLxIrsxAg6st0U23SShtI962`x2{SgmAuq4j=oLUqA(%l6RCp>>5pSB%*ZLlC8?Ikv z32@bKzx|ySY42poaO}xGtQh43XgVw~;9$13Ne(ntzLUtsq&SKl#5jDb{v!|9%8p@) z)&-j8LG!%N>`I)!%g+~&c(n6ZsMz!lz;p#CtO{SwubkNn0Da7r@==l<{~HU?18g#k z%1$fnq&1ynoI7?oyZz!7iK*!-jxdZ>Q`0NBH*B@3D|gcvr9W{rP|4UrJUSoyE-sz_ zT!#sq_N1Cp$JighVr&Mm4uT&cY?3#Y7p~kccbC)M6~%_q3?y%FL!aqcunl~GkH;g( z_!T+ewM`Z>_JZ0XI#rOmnc!8XW59Vui^$CjE%zadP9k6@2n~>S^TX+oLm_ga+2Zzk z>wB?a3n!({*1{uNmfvNz)}t+r2JKm4e!fN!bfAF>C(pbnOqut7(XmV4e85w%7Vxr> z;ww@IeWI)__zexPKzL_I^SoPQMdGK>#A#lsZXSqD>zRw=sB7~Eu5MM3CpNDLocfd?};3_b)2qYptzC>)t`Op zo2v33qNA)Xv%O5vrX&=wyj^6^YB?w*RQulLo%)I} zKh0FRy+mC1G)()ik56^J&5*9Q(1=LTnRUdRB$0y8p8@{s#vR(^I?mLd0gxFc^K^PT zLX}%C690D-yL?@!eD}7XzNhxLYTinIimn!()Q?;|?f=_v)^Ul`1S7qWT-~E)q zQtn4xvN`tJSiXGIrC@`B{l!vRc=Ro0#LOzs=H{kJo{_6~nOv&lMx*-ZeMW}Th4A0` zMaO(BSCfTFG{33|-dXplu*t$8Hge>@=SjeYUyi()VDlB>R>j_fi{)5(eW(9 z9675wWN{z#oS^ZYCTq!wd59_dEY)G0f0jU5=*~cLahqZ@5#M}^ijxEPoK8E=-j}HQ z0_df&`3mIc?OmUw2-)OO=(+IQ8*2Oe5;P)H9|8N18s4)j87Xz6r_I@ZkGQnKNjO5U z0K&P}FMiM9rBojR_q*mPLyTv}J;!bb-Q?5a;@|M2haM@y014`@ZCsXW zQ#dtEmbYWms+$Txz&@lpRrPX1vmlvCLu36u?3MAjE3R{eO^+Og8V#~N_=5QHn7@J$ zp{TsR=8b|O7Cb2hJQiAT=#-#~86S(pDlLN1xoa<^qn7PevDL)sqA>L}$PBVu+DoN7 zc6KO`GwYB@(Rz}VZy~Hu-UZ|Fh5QCG} zXr6;Rujm+`CQZ1=xF;j9at1s`1{U^w9KraMjg@Nb$ovz^~0-Gc_78qw$r&S`-H2B+u!M7F3X;U z`n`dMSC>Bjul2$}r&sJHX!ArJ4LC)|R>dzbhSDY^O=aZB(rFr;WEk&9<%~}u#~-Lt zUmG>|iCi?ZtiLw=8s?>8SYE~1{(3DSKp$|hh{NhSPfjBN#Xw9$+WMIiT8mL-cKrPr zeBqz>m9E#oe{+O3Ob3)WaGjPJ z*lBlf+h!*N|4I@=4?GEAY_V5mEnCn8eOa3sySZB=UVU3ZxFAuVT{Zx!Uvzqq+>0aC z@FgDE{s=!cH72lK_3xCaC0|U$KXYp(@S3KpxG#0O{a82}6a8gL zjEB>XtBUM`VR|`PDF8<@IC9@yzpoR^!i9Hw*OnO8W|NI2WDNhqOy+Hl-IH>WZqrc! z5uE)6uT?G|rmJsT`CFSH==LD&3w5@N7oO{PTjr#{N2=QIP1P;&_{R$4i^im{4N#9QeL*;=_(AXUZ1b| z%RZ^<>ZT^5&o9B<1BCr99<7Q-9hKFeqoa(aRg@3e<2&wmM}?kbXZ7bxA0<*F$Lx!w zlq5}5nCZsz>&+hF935?Kb^^MRT}O-H9=Z6U_Rp*A78TPPoxPZ{nqI#p4eb~adE2>k z4rBd*W8i=;YhWgmI4-vd1|giB2tS~RygTc}ntGM)&2!{g7j#8sr!(w{vAu1BGNW77 zh`7zfw|OLgMMrG0CCoYjvKuaTV{<@W^4sNE8nm7|?&qiVo_bRhxsE?t>cbStO5U zWTK>6p9nQQ`*QkLZYyc+i7#(u3hva7h(E)KvYeL&y z0m#F)z~irL=WEBuaSGOJ2kT%yuPRb1@w9>Bva>&{X+^53)jISa+n>>ic|1kM{d!ko z77Po_p9Q>LIs~~82cbyLzBII?Nam;AXGcv9DFBNDU?7YlYxtEW6V;d8_G*eazV;wr zO(5kh!d({Z4U8r1*h|XI>)I?Hy(*2lg=C1nMeRukRrQ(6kKHkj z6q%YcR-H;OZsq)_%V`voNM&bixK}$ujaK1(&gdV*B%V=6mcR5XC;yy3{oP;;5@^9I zU{WYU#;}N&Aj++-ZL(>VR_31kWiw<{oFnU_&G!%`r6kaADtsU* zpGB}u|55&LX;I5Y-v;q8ucortN0aVK{-wJpB?3H25*B;c0IL!12M2^evidBB>09#VkV2vAM zlYoCp$aIkbvTt@6pSSk}83P_pyNUvS>-&yNw`+eKD5_a$>|*1$R+a~?85nGkc?`{fmlT{4G(t-EX!Wf3>)4r2ddk zZXT!tJb2WAb(~fWoeb&I#-ERSi+Ix+pFN$rh++IenuHWy{6Sx$a(3HL*$&yvsyU~G z3MZr4Fz1WYvMe$+rSH9R(g(f3uZ&r{$vQL^F~t;~`!$ z}@e?-iEa1W2)fW@wtwzZISX=G1Y8?a@8wt_OJs^VLpM*?r|!TpMaTat zDFT_&`bZCh5oq&7H5&J3`P%rs59j^41ZStFfjfs;ZMkYHSx#2j^Q1CK~r++mDj|{s-+NDVFh&$5)~5*>QU9 zj(u$xX>%Vg@d0sj6wbi`_A#dDVRKIuC`9&mfu8p@Z;B3f<8vI$tSCZnE%{+;Hzrcv zrx(h&*NXPF@ZcXQbmF62T%;cN_V&4R6Qtig`PLuz3a0$#OkGqOloB#@W*>T)$)0Z! zfC0+_D|bVizyehkiM^TVvl!oAuG#fsns5*lqBEwzdf@A6ry|>%N1`h?@ctCr*ahi@ zYPeIB=kMpMI1T5i(^zlAv*q_ki>sZirVK}UGJ;;?Sc9czqz8}f?vP3~M5vF*QG=bz zxm_ZAzXWq1;kbo8#(Xxrxe*L>@8C)L8a;7!Dm@kVta-d*w0^6$kcwANzV4(o>rm(x0yQjiw%ANv^n)>kyd!4 z9d|z+f@oY%qexSJm>o)}9#kJ8EIsnR+ENR6t@~H4_WhE&d5fjq$S+#^LO!88xvj6c z<>7Zc)ZHG*drl($a1JRRk9+SJz7hZan9(PNzJ_6ycZd=K!9DcrEK z_+@HN2Vuoc#8SP&Zke#KprULX2GBv4VuEQp&0~A$CF46DgxUp?yBd&uE;U}iKd>x| zH?2!Z3b8_937_bhH{Ixh*?7BiC-vBTi;hPGobW_^)<%omzr*y324Tw`d9h>fuT$&6z&B8KR`ZdSfrdbq&-C;f-I{9ye zQdi@z3W(SD|3jP~(*5Sd^z|FW+gz{~fcwXo!5My_r^NqpGzx?Z3)LFP`asaurWFYH zs`qnHb03u@H=jpXE)+5gDdZD@?2=$%vgfxJf1v-*Zzuy^+k*zLyJzR43HVH)j=L4z zqds-j*mM84T@B{kW_XR2uAR0E!8_|)7ObLFy$;#Qf}s|LSVXyb|Ccke3b{ik9*(@% z*S2BOr?-}_TQG^>E)o&qff0@MU1C10C^sFggMeXk!^618;2 zh{7j@*a4}Q?6|`cUcad>7#%XUiGK__|pMfzc-_(BzKI>6X7^3 z43B}Y<0I3Liqer(rUf;KVF2&8kk0X5-+Wt+C3nRIb2oXKP+J@*Yt?gI&h>W9h_ z_s-X^N^kuZxi4F62f5uBZ@O5)P`YZ6FetL5W}(P{-T>i@LVC;)=9Ka4CO=LFPNBFr zXO2ZQQ(`T~2`CoQpmaOPS1`w}K&4MMmB%Oon#j6Fct)r%TCE6ab6Dy_dR%S$ue!VJ zLkUlAfCI6RuZXjq@l|sA(9FyB1^T9EV!-jfk^W4RySroa{eoR` z&IZiq1d&3KQLGyY7zA8_SHOSVN(3{jJ~5s`F^P zne$@l(w&d3!$yvR`%mTLRg_>#+(zuW-{s$5ID)SZXxrwios)0+QKU^TPdYUegJ>Ji z^ISy*k4fF#zK!AsIOeGvz8l3w%B#~|JB#lES@N%WNFdk3TsD8bcAL^Y+D9Q8f9S3Zq_%R znmWx5CXKcVMOC-h!73Vl{EdDn6pL7S5Jl*b~*aib#m7HkiAy zEo>|R`b*7<*@@-h!^VvhP1?DdCby$Dht2mSkL6vn1XaZurI@5Cz>}!0gH|#-qt#qZ z0pXkU^~ltB>?A?^D1OVi)IUblrxUaq*0<0&Y;cP%5mug*l(m(qQ1+6kKG)Q}Gw^?< z!xGnPV8G#RY61mu6-yQUh>Y7dCOuI!z-Tg0Bp=aE#5!^?CT7Zt7@EAxBWU(0t{l6l zO(#)x<)DTMkIH{s$GnXP?TD`c8oubzm@ZF{LIxqr0eP~tC!fS@t;;2*=ykw?5r&(l zL_WqBF|62v=l-0wra#O5?RBu5%Ob_j^F?~P=e+x36`bvU!B&>`8P*d_+A4^Prh4&m z0PavB>$WL7q&T4>e)?d%wxf_L9n-|z^)MRI>AfH&D*r{x?YVeg_>xL9?4kZX9!UM#U_rf0=7k>Ts* zQEkjOkwY8k9$lq?kdIo=u3iFs+DuV%+NUZed5EFkMmTSBkH`zyRAzsOsaF-BA@<5> z43A6M?cIfGzkbA=X>jaJkSUOqcgNRr zA@CTr`s&ouT<4g)Ib=#xNYf5}E>$+v{ZK7Dzp&Rcu$v;N#q_qT8 z;vDz2#5}>xRJSkJHU6tsI$qE1l_)z@eVlBTLk(kT@=+5^f%rU1_Od_#II~f+%;~7< zM49C5EI?gPH^Fy@jgB%r3ag7DSaKj z2C39?-Eu;5f5NHUxL~m=bxH5%Vl%x@K;QYfyj7nSCLvfUh09sDXhg`eLJYfAdpJ*H zU-;Ac(#EiRii^$m7n`kL%i#Xb)iV2(2tGU~uAh^1aiZPvMS~tbtq~7@qRdLDtcgAc zhNfv_pxp(*T$Ubbht{Hng%}D8|xr z^H4^w(XQC>9nfQt<=~rEk}M^r^4yDSuDG9C4%Gl(MuOVE;Sa>_SWR4) z%KkkZfNe8y-)En64_tLAq8eHs+GBxNAB*jCAXp`tdSj zL+Fp)oq6Fw5$0`9e`*wmNbGPx;nay^uApW6k%p(*?TY0BmF2;@&Si|!^s##h5EE@!|J>j>Lytm7^o(*<)+~4QNq$i!YfezB@>dKYjCx^Vt0zPF5 z2|aCf${efJj(=Lv=ls01$x!ndKzXN@skUtw>j*7_jTcLTvkl`OWhZ2w4%C-NHq3tI z89tyNCB29h)0o6VyAkmwOP@+F+v;${^Y0YgxU!&kvik*nhhzW|$>vp~B4@ORl3|)& z)+J>moJu%lPzooLGPM{l=kd^a0IQKmyJe^ia~`m!!TXDdQhf2If*&d3(e(oh zm$v}Bz0E z0X7TR`QkD>#yu+62jB63G_#}Q_s$TWyRY2Of z@A(I8Oj&@fwDjpfpd{gnO9S(W3CVGNVQKw!Lxz6V+E$_Hmrx$A?>{VwP|<5Pra7s! zGLt_ST&$vUc26y=6%Dbeg_Ny7ZAAq5l}v6*$uerE9do*I&g-B)EitsKLJCNp+viP{ zowTHJi9CmfY(;&6c;oHU;#ky7U!&0O8uaREVmaJ67qSFMo$aw9nL*0gVW*-&Io2pH zzHo*@6ds*${N5+5rfB92bO<%SQHa0qR{;S2+m5o?FcO%FHYY$?~_f zwziIpO#KxC&;94$8_WNXbn#tlq)Eir-tMmUg8qks#28|T`!K%xL2Xnup^j9AJc)JH`M}lV<$CD_! zOP|uJG@FVAvV;%j*$dJ%)RQAK5I=j_C#$P7#p#yMqsgsFA>{KLR=0W z2f^%T%@=lzh%e@RzlCqdQ1Z~m#z;L&+0Z5PxQ%xw*2{r0LGT@MqnJbHpQ^jNcvL2+ z;L%^t?3?zpPrBW8s_`*CJ=;HbW}Ppkj{Y{UFH<=6cu!v0{LAKv#7o}-V2s{T4jLxh z@No5}FL=<|SWP7$SkgQj_V+%C=QSFqcrO+=*NKFLzqMYyb#Pbk{HD>17GZ-cUrk{{I>0g)*MGgd*DsT4J9slY=#C+l zo~#!MFuX*kNNYa-dmeOV9hAl#HO|1K-_52M-BlZRArnB5`^F zpF`3lDKT(Dhw=&43z=-I7CZs7R)xk#D?O<7Qiz6K0Idsb3PV4kA^GE2q$6Xj6`*xC z)Ek<*KuRA`?UT-8XHr+%Rt)$PBV;gV(dcEucJTtGauUY5wy((Vs)Q`f2mkbhA1m|p zk@a%MCX)KN;2B{`j~^3P&mau!%jrYg1C3lFLr#-5#mR}Ti9A4YtZR9G+U&fP=0Xaz z4K4yacW;oz>U5tG4MvEVvZJ{)x45ONj_(CHQD_{L?etqM(#n6$soI&e1Pf+6;)g=y`f7M5w>Ip$e~U{e`tz3e^_v#i3+z)HwzD<*Dm(2sjSH2S( zts%yQVMe5Aio+WjTffSVBg2a;aQ)OU{(#iZZzffTe!InzKdh;ry=V1=uIVK)+{`!R zL8GR~SlF;nTvd$JDw~7=;vsCT!5|Y$0HX87Itf{hVh1mh792Dgp~1=0H`n>+=Z;Xl ziKXqP7Q4}u9o12Vv!~W-*FVSN(Mu`Z8{NF;FCw-;?~Ml+P1iHR^WQl+G;@z*N&E@6 zdn9qTsaZr7Zl~4+jqGLwW1AY4QUv|7H@R%&LMVdAhJ<#n#(9HJJewbc%@yqNfE=@1DE%PEHdws8Cskwf6|C+D~q3|qZH53Pn`K( zFv!tQ1qH>4eGfWxd~RA*L$U~l6(C{`FbdS|Gy2@8>3-u8weuoEv2(R(?$k~+pI^kw zMylb7RNhO$1+MT^DbDSO z<&IlhT$Q!?;NI4u93bB&h|{Fl$=(ql<_3qc>kfs67L%s6R@z#VlXM23zSNt3CFA8F zxt(95tR4*+SgX1fOw5N)n4jEqZnHHduq^|y>+-~ueh!;W5E~|=MN;y|l zR#QgUn1ufxs5TL6y`Y#f_c;~owYaJXO$D>WOk zb{RnR+r#VGGc1Okeqg)X8PDFt@=Fl%^xwBQH`ETNL+Rnk)Ago}?B?6wAjj(UICtMp zotIlXg1J%a3B%aV>o-tF0Dk`1uNLO#r&o9BP75JlyZ18ch?Jxmbtci1Uvm2KccbN_JUJGU10*%M;l9 zqod8PCVTZc@PdnuUgHRrMg@gOjLR|XH>`}S#RAlu6FqnbBbHWLJFJKGw*-kO ziS8Gd({!Kvy_E-KqZWFym!N7ESDT*C=z@-)_-hn)u@V`Nug{Dp14O~@Xk!chuWl(F zjt7$V7ls@D7QcVW>mBRScfToytj0F_ z)k~}OzR%O`(N#F~E%HoMzXdPvCIOCnsbr>3sPk&x?sE~{O|rya3I!FVvLm&Hit`C% z-UJQ0WkTSE{Oq5f(dzkSc6&qE(*$K1iAyN5sy8JCbbT9<_SSFv`^4%ND@jadDoQ&X zaIP&C?qku2@ZHz_@3CUbyq+bWb+7@;zFLB^p7;R zZ!>=rGm=#y#?1-&g!Px zcN`gQV-v*9=bH15RY}pGu6%EHd4g!wqZ^6&=K3^nsx-S+*;dtjOCu8EyD4bf?k%$t z1~f-zrvIp&ZGU0Ej=D}lQ_*>1`CU$-ac(PkwT{Rh5*fA>8_@G7dpl6fLPITOysYA%>HHr};Hu6HT5s7QbN~L~fvzk-aU_42hfi44KnV_=G zb{XAOltybD@q*I$u((M5)<}X7H-DSuVANOFoYzHeO6b~8I(YZz}(c@%A#aY z)I3Fg+S5wWRdaV3#wSupS2m)0c-+_oxf?`lDR+w4R#%iQl3VHfy&>OUiUyh1#)Bkd zZxrj$*u8jzXnW_q<4QrTwvShKXE#RA%(2B+nclGxYTODq>&{2KL7ZxtGqhy^k`Bv*rX?Qx%#$eN9_`69?Ikfm>RvAuBwCnytB2k#kxw{Hu(X*5{J`(AH0N6(QwJG=m?7N@mCR#GGJgMd`LK zhq=LJ$H5u3`w7o7fu0|#1$@mU`sL|7n_ctmW_b6-PBqU9UnAHbp=q{UR2eEulMME@(0G`Ip8h3A4By_FWug8kq6Mq{}@^LWZ2 z*&!3XY9<5Fn^Vv*(U(dUXwbx}IVzwMt*T(NtZxl*d5b*ijboS1k7_X6_?`u?DC!E- zwMY1hyMNWm{pL?mH;!Uf(^LuyaZz%R?!9U(^L;o(Bezv2`hG?h%M+V9$p6tA$I;PQ z_!|XwYKrNf4ynX1CJSiMyrKveE+&?j`(`;cr(Q+q5gHqvw)<*`sk-k~;A8Y0%caXc zA%4lk2Cx2wd6&y#2HEU-fhA@7Nj-zDP9}tA-D_++D1q77#{p`w-Hz6=Km%@(ZkAgm zjs7`X+y+qE=Y6&&6+om>HH;Hfxk5 zgvM3M6Em^0dFIB-bj|z9T1Rq|*4P5`^#^f0&?0RHNyq`GF&>lH=1orN+<%F`*29%mM z8IJD1-*=qc&R@J1xH^5ORHH{RdoSe|s^I9{{QUhLdmfP77(}F_tQ5Molg@sXH=7br48b3lH($JZ_;0W2U>D18&yjBUK3Ik=7~W6YV`G&v^OIyd zitXrtqLY#Su)JQzWL@I(x_f*yA(5zPe*GB>)tFDatTWb47aVFmeeI+cJ2< z1|3eadzlH23j4IpK08tSl5%gMoU8ZAHF-7Q_sR@u9f%0UIr}ity?y5yO7H4IfndNQ zL}w1%yoY2YU*kaSzv6XczqM_LPB@D)xZxI;>^tY`=owyk(5!o|>bJ)Spk=Vh#d{aF zsdZB{c-Wv1TM(31*&JVn=)w_Z+3dR1$))qv4VJc8$h2j)>+=VjYvedo$Pfe$RPuoN zT_@_pO4SD=HlzD3*zIUK@TN7+^jmr(9-z_FM$P%EuwjNL+@9ix+lZ@qjAnDVHAZOd z2w7{+TZrp^^x4{8aC{oGn6%!!V&L<1Ys|4;`t+v+yoB0zFLvTkJ1z{Ae>N-#$f!N_ zks8>gWx~|3yNF(|SK_#TjdiBvom+tG2*d_-fcA=}fO8Rwi4AZ29mrxT#kdR|CtGI0 zavSaM1$y2J4AQ!TyKIBJHX6=4cU``!4jM()+S_n-Z9bvnwvOa{8j^XiK9w@gQZJ@XK(Kdb;%ID+)iuwey`*sH${&37lKptdXd*oT-!Q#E-~jR96h?#OR+35 z)NRxjhxL47JWP$hJ5EM?2wInuMVjnf!Bz{KK*~CA)2EJd;XL!&dl*1`+7S(a1*Ll) z592-IXAJOq7+)Z1T&C7+>mGLecOd1f z*vPtB2Jx&uG6Ne|iQ;J~|8jlW4r~qeYT3+oibQ00d}zMO&xc%mq!4P%Qz^<1@VDE9P%8z^>1L9} zW+P%p5iKKgt$Ig$GQ9}57IZc?6gpMcu(|ysUh%%Y%Q|se)M+K?q3xY7_@;)aOnI>^ zx-OrksC!mPH;DJOsZ?3c*f`0A{Z<4#ZI)lGl8kuLVoXM4&STfJ0=vZ-mZT*3@642Ex`|Mz{gGy98wsU-q(&6^7P95vkG6)Lsn9H*|L?uO2HPPK( ziU2b1xGOE+z^r&~OjAy3w((8Z--GlJ_;0uZ<*86HG_z+*wiQR&>rx}Ppic%1Q0Qir zb|m?Q&S${7=62w7?sE8n!3uU7*S%g!XD)m1!?%;Dz3YgGM@JdsVZsymGT0>N*4I`D zofQwyY*z*q0TQf)v7u#vfuWQ)mgWD3m;S?S)R@w7e_)S>^RgI3w716ZmYwg8BERPm z4>ClW7)@rB-oj|+nDMrf)mt=<15KiuQUdqaU&&f9(k1!ONdYdSC|I=IGa#PDzzk)n z*h(IqUqbEOluMJl`9iABrMR?dnUQqx6Z-+!9Va*29P`nFPr&^TRk`ap3C3;lK`Kgf zx*DuxvH`lgGwA7MILq)A6$n978k7@yWEYDxw(DL8&1S0$FF;;FGiz0PqC*DLTRlYhn=%5?aE zD#Be+q?D>%Nz4ke$x&_VTa$N22NPNNSL2>)e=~KCkNM)Q?IL~%G^Gx-ZqHGRn>lTK zivyh2D}>LLEm&|9PN+7J==@GbAQcRC3^r!PsgDQnyS9CQ@^RM2a+Nb)B&agE2`f>R zwO64%Q%w!Yix)A#t2aYJO8h1(y#(*QHq$4o^*6$X$ADqacnHP{#l8$(sg^pOIAyjZ6KH+}6OFZeSMLuByMh#rnTGNp1o_c0{RvR0{1^tyeDJx^veD zcgOY|w+*AzcM}2Hiou|5%gNUzjXEUa$zW2Lc{{6=LO^9f~K{ifhyZ`J>*Lv$W(o+tO+fL!4 zDS}A7+Y!;E_WYgv7to@$yU){$eW`@9r)?z*zUpY2fj^P{?HfI_Z3|_WCRSRvn+^kE z_4;i~@weOIh^o%2VCygQ@(hKB@FAH`d<=Y%LgutPmn0WdYyULZzl?^w9 z^N!VKMww_83m@wbM|3XRDJ62@0CHfnq4lqRIaI;LLAi71(4|NBb#HIukt2!{T&HEb z7FIXldyTi8Y`M9L z9)|m?!a6&KIzyEAPJyrx$yeN{0iOuNZT8I(WmA|AzekV1J78IVpMyLg(J_7mf1dVE zd1M;Wy7yV!nz19*>u?S)(#NN9&lHEaY$2^FP5t`jbe=y#Z6+C0fEm}td2W1~Oo5Uc z-s>a6io4sXI(IIs`CCh@NPuqMkqZwa;Mv2bKuRs6=F_x>M)2@`$`lQyPA&w>GxMlH5}r}-Dpl0uaZvZA7hR{j76T=TTnug~ zPt8N-K#%i4_ERcd`}LxS*f-7Rij%)hgGKb=JHswd=*}zJ*8M@;A`saf+)ryBzDk>2 zt$83zU0QW#D6#ia27yOA~~z>hrk-9xZ|4800_n5vQJ*i3s&(GSyqd-_1L7aKK)6Oau z8=^VbSnQZvZ`r>lzGE+2#VKd0E-$B7;UPXf#>lf@wJ|u`i>DU7GH*-cv%3uB*!L)O)J_Ph-OqRri%Z zr(B?f@T-4^(cUXq85Ys!>&xcX>wx!lVjnwBSACxEzONZqS5B~9Uv99!I8C_T?2!J! z2_yjem^IfNJxE{AyX1VpRr#+Z&(H5j{~~q&n=}4g zg3;~`*DQh#BezL-{YnWx{0#}3_&wfPg@a12JMBMW8N(-yK-X0a^*#+Br7jEy! z-t`2}$|8e{&SNwT_yKLJ78?HuB2Wy)^z~B&D%s7p849Scd;h+2m~W$iA=b_2c{7>% z_Zdnftrlsrw0Q*Lj5if2Sw6=4wBc#dej@hY!T>opyDsfo*C~4IpnHP~V{N`zQuG%Q zcC3neE`XK}%iFjV({1m)ybC&EJe9@kEtszO)n{wz+if%o!oUA`fDTdGpE%*L$`~j0 z`=Sx;eLL)KCmgB1?skt=*W~Cv9}DdB<{A#k9vzp~^gk%)DK2t+?*ew{7+)|X&qlGi z5F$6P`2!~$jEAfBI?Ohfiur`2-X2Qu7+%IavHpYcssNvXml9jcPqOes{==c$Ij>V zS$;eJ9azV%-exrD7F6ov=I*>Qzj!EIXANTfSWI36+LVAszoz&M&HYFY4iHK&&nOgyh_oOo$tkwYd6(3pi)z_aJc>7w%W@S%A?laf(Xk7faHA3V=`*X7Xwfg`KfnlI5w9_V=!Wuy0Qb3Em zkN+Ub9RHU&(-7!Depy-BS32!LT*8-Tntv_)zZKN3kMGUcP=GfO`&=?F57BqgBvwTe zooDY|^qawRA}pBxk{|_POfaCAhyFe$Xhg*2;K?eb&@&NTX%K>B07scf9XQ9J!5btM za_@5Ff8>Ra z5Pk8<#$V#K@x26Fb#MmwjkKAQ_)nDQwY_=%BsxF z%SbdoR)}CzCgU82b3A!`Pkpa+CnschhAUw(F)^LB zARr9CyJg|~ySwGHyV%%&oQtH<;C}!WDlBQpd`n2c=S?a6`0?^~|88;VWd0q6EE~@7 zrPLJFB-ficicy6IM@+nA=TsBR5yHus_z;>Mti#VYBRIEVNG#+D;5ni^P4zo|w-j2a z)JjWA%F4+}%E+Kj5sA};^bJ2|=lK4TUW0R~*X&8%V`nvDbOfsd#Fo-PGCaBvX+}=ye_TeoX3dO-uO~eY z*@G4=l&tVc)+f>7KZPLH$b0!Lop_TdR5N8myL#tL0#UTzq`UL{pMv&=v7aO0{;j+J z?dJ4Zgc8X9KJ8{FY~F3@10_N6Ei3K0-tUm6=5$zC=)n9@){WdAv%p#d?|O}6CJRH4_K3sS#_fZ37*jl6H-5Ekf{G+j*4IK>?= zJ-yCljJ=O@e<+$F@|M{_oUpY3i7u zMPswcQi)&%VL>Ui@PErnRZVUFczzGi@|>?C^6xMz=bCV)UdUl@HznPQF^K;TB2;S; zcs|WLV59!mX>qpu$V06Es7b9n-7d0aOkfDF{sW@?w&KXVxpCpjT3cM?A2(IRgrHld zAf-Vv4PP=EPEUy|=KpC#IWF1WWoJ`2D8S%gLK!N7iYVGSqOh_d!|U$u{%;Q@&dJG9 zJ>`7n_)i1#x^({a7J;M&@s#qhva@^NS^c7bh6ri2sfwkUD?#*VRgp0~ zV4)aD%R}1^Dc^qouOH$4bg=(T{paX!4)FiaZNNz!-eO`zDtqew`4uu6khwXohxA8} z3KJDxm`ObqLg~9IZSmXXc6H0-<9iW;*tLjOhubX-#%f+d0^O%b#fQ58Mps$KN0o4C z6szIRCfmKIt)(0j%burT2-&h~e)iA5B!}vOTM!ZFP|%Qdkk}hdHY-BqlGNDPtOJ+b z%QDe67Y5TOpsJCHL;Xat{huI}K72Kmv}6XxubxNz8=fAJDv~eJuQw&{Sy@@W7eI{V zGm|;6CA=34ZjG$cVB~;_MF&t`K|~A|8cG)mGP(|C9FRS%Mh0I5;}{OHzS^FME<1qE34D|N_6 zp5IRF*V0_if#C8Z9?#9S?ss4N*>D8LkLs&KCC%?|@L!d?9jDF|^6JT;NB|4g6DIltxWiv(BO@2o%m@= zVzDJK`q}&L?oSC}Aq}^^V>vTc-Q6?q_xS^itdGW~Yd#l(^aYN)^Tb{!Z8_S^B97ea z*N0D*pa9WO(GInU&ViMIId(BPYX2-{ut^jh$Wi(!dmYrbm z`S*U4(pi3+gGFhagpRu-FsVmHP_>_?X%4{Ua?mXX@M0C(y|A`ZIazdi1a0o z_u+ht+g&TB@wm!tipX*4pM}N7{S>nSSy|(1VP&0a?V4m@WO_bEgCldx zZX{P9Yu8c#F&$W!bkUJ~}%94t z)KI;ld^I#WB>+d%k}S7D9r(hZ>vi1gTHfP8H@)F~+(X3tX7?jz?q(&mm&VbJ!Uk zqtDUx)-hakY*G5p57+)(oFSy!&F#w~X6l1g?~-c9_X2kTZa%nf3#mE{s}cn`(nVT} z{_l=;8AyfM>Za->HhZ))|jZij5Q(LPWq(2xNn|BT!lDH zgZQX+_WsF>`wqNeU zEJjPRm@H;yYKxhfnVDI##oS_MW@gEfEM{hACX30ExBb6+-+1Tl&hA9a)E7mxva2g9 zE3@)Ed4A8ysa9Qg9$N{m?AgXe^)bvPX>Vmhn*5E5tz`B^(gyNmORLl=#4J_y!z>pA}$qc`#ruP1<-l;`PMXi&8?y@;JVaKyU9$I-9 zwEB!m-EQ{G(y~@0Be&sq*EnZ}2lS;enw*+(um*L_(Y^_ap6EVq80%JuToz{$;k0C; zO!5tu>)XF9A7b{KmL<+6vZH+Ulg8B6)QThFT6M7_PLJ_>_=!$rwLAmywPW`TOV_*< zcN|(hY#ZSt#*Aq2-bT7#)JgXx@GePwy1d4CY2AyWzP7E6eLs;eZN3=i!JF}Y21-G) zN>7$4*0{vx`JKOLhOU{77Bp$!z5pX<#i!D_tg>NII7G{;8W0|-NT!O#9rMM3Sw zu35HA%O5}fD1QIYel19nlGAb7&uw|I;&?ajcwp*?r3Zr6Lg%pAXg5?gEr%4}p#z~_ z@0AXl+9-v1>I!9>p3(18#aWIM@+C!ab?zq0c#3UyTc1whMxFW+b%;;gYP5@c-(=As zWlgpRTg|emb$bi&QlrS5PS$h0`*^Fq?Vz-DzwhRJbCj;_?w{8xdE0aUdRAnGu{NA( zXVqSai}+m>eBTCw)z^<>3=BreHQd@5JHy(M4>;dL6`khVts@@sN6zi}*lmqKU*hpF z*nP_Fs-=mpoH09ZUK!t?tLd7pE~-px*l~_nN?zARDK>oLtRxLc0o5Ywg$EfXvK*SbIjbM^%$b;f4I3(ownnn&K3t;uVxmz-;lM^hskAZDVy{@Yc^Vn zvS8h3X}8w9oK2LXOi?AUvSZOLEc#kKzMcwvT`#S?$v=1Kv?y{i+d{wo;n%|JKpHP! zygfL?>f%)gu0WEpA8$bsxI^;8_U-K@4)tOLH+09w#zsa`^7?XvXvz_zc@PC?_vh5t zWx0s^*Q6q;_rbGcz<3AYpKByd7q{-0tZx@KF>5!0-n50v75FW(#x4b(-*FLxuu8)i zXvQN342*D=Vn;Ml5!($O@@>Nv10*;mcV$q%X>#4_cWpjID6ZO+1AR& z4Pe&(zPQk$Rf1b7kMKE}1Xg{iV2kW>AFVo3n4-M6a_r#uUyY|Xfnk)|7!1~A0U*G| zXnDO>SzPtVTP@tPyVOX5`06Z7_1fYCDJXM;%U#dV&bIJUu?J%87 z67Fk5XhEe*eaVK4o+4)DHNST*lI+M7$_wvY3p#2#efu|GSGKlnX*wD8+b=o)toYVM z6Orm#0*B~X%C>)0f$gD`I^DHIjs6e#NE6OkK~eK9zRZ)^ACMH=*&X{ zjh(AE6s|A4m;A0eaF({F?QWKutPUG&@|2RmbO>uj`^$zt@K-_iEGONH-21(G%v)#q zhD5ZSqST7o{fN8YOTpKPN5$CY&2rAi@{K)fYKd?&#`*XUfE-fJ2(F#$?!#ZUek9lK z-4z;}OAJ6QcB)Uy%^SXpMz&`cF<*YfH7$_p5}-z28>eT3-2LwN@fL6^n5;LFeN^6d z#c#{^!Rl%-ETR3*H4 z!BXtDFElj0mK}_y=kAQ>z(ua_06^aS(o)E6!XssaR+Xrz>1}#ZadB~}#Rwg`j+5wT z)SW-qZ*?f&8k8QJn;x?YaFLa}&E9an#xV1d;jov7%&$c+CjTTgM}WWa^76WH;|23d z+tPZdy6Lsnw)d>5B#0QrgZl&U?G+C;-%dSy54`T*EB%sp^^38IgeW?DY?y#u0gR@v za#{Y7QUJ60xdH|n8WDAf@=_|B{!z^gPBJZd1nA9I7m+agr@2m;jPloak9Nd37HH7# z`7pSpu64Eh@Q7}!m4q@^Ba}?b{BaDuMy#zrYkh~2b=A;{O!NJ@|MVDHEYpR(J4X| zM2KU=)6l@!c;Jyt^>!WXfydT|bOqpuSwVKBGhs>uSejTW)y2ic;8%%PYhc$%MeSNp& zMTiMg_i_6bnWg4sB=M^qXwa;3Ax`=c6Nnu z$V$qsKky^@wR%7S=-5)${;Z|A%t3=qZm-s|Dpr<>=m}}TehlA5-JpK|dS<&ix6OYC zYob0NH*WrpbD}Xu6(L zGf)5>Q|y4s^-M&dG4OVqMb*xd4y8Kw17I##)}-$fkh7$m<(}1Cvwg^Al!IiH>!Hlbwp<{W#>Sd*;N1yb{P4u` z^ErYF->_AvpTL0&liuTociamGEL9=|xn>wZiYLd$A%-WV*xK*9Sc625^j~Qgg;kNh{h1@YB$+(CJM`TU0rx z*DRglu&U)NV^Lp-zv=Am_aOS^LvS9`)r$bZ(!+(uZwqGJ3tTgbhyo~{&;cTgCY}Eq zNMAFzuv>b~N3Y*ARkT5DleN9r5Ozr>GLA%-nln|D>E)XDHd}V8JCiBbWMy3`tHyJy z-^U?$niblH;6S+5@}BSPWB8hoqY)p)vkE;9w9<0aYwn$00S1{sY0lPVgXA(|s3oW* z53G6DVDMunVYW}v277RXGh>q{THKrNQziYJoTNBrHf`?2DGMoBWG13{C>a?z+2gr| z0hzp~SpG5MDg)GF3teT>;}UzK-V`Jo~wGtO+y+tDs*=i=jLq?B3U zY@zj$oIwWE)7Ysdud`m5hw7tQ`7@7qFCt0|?3_)=5P?Zz-7Oa*EwMTxImTsDub_{G4^1X|2`Y(DO-3Zi*z9l{RDIb%1NdVLks(MMdES2~82zGZfc zzWjVBe^48+clFyMX6fEBW)N{?pJ?m2d6Tf6&UhAP3X2Fl)KVosFS}8n#_nfk=E4Tg zJY!gZK6L9BkbJuMIYY~RB|?fcg%$iPe?C#&+`>nOWcbdPF64r~J#oF5K0z6oTs+{} zujPq$VoK$oX-g9y3Wut%h{z@OotFuK$T|Fb>wZHL-x!HU#wNo^r`+)H6<9wwV8Cwy z&FL)p2&pHiCAm2L#wSgbpdMBRy{F>|TSEKG)-eMo$Tp0#w}Xq9E*?nAZNEH){F3X} zq7$?+3!u~bIq>locS=k~k8?0w?vVGDrz{;ghYcHRXyA+R6|Cy>WJNJ}RHt#}TcBEg zHKvT+vc`2R`;6v4Xjd#2tLI*O2&cv+H+46@*ajDyLxw7r7n0XT(z$s(8j%f?QDydk zZq|S<=|So%Hn#5U4ERnf@x)>M0*7LFc5$3K%l7k=Cu(4z@$f-GgO&=Sn5u~%5eA5P zMFw$(;5p64s_{`L#gFAFfLKBc zKS2}@gBdDf{yHx{KuFPBy5Rt!HTpB4_W1vSHYdDZ%wZr89@eK0H56fz+QdP4kOq3{H49;C|~kxX?!y3uDw)aw8OJg(p)cM?da zz`>lGp=jeX8X4b_(;MPAZadys80Yki#YsQ!Thv?xz(+E)U%Gful_7xTg8)WgfTy&im2}oaq~!o2B_0V5nv3FLTlr#4q1Ovlkt*k zkD5Bo$%G&s7qhks5HdT?>$qs}p!<`*J}c>!DJR2V#wv!Ns*(3;&m=dLUOE|@u^uJ! z)Ky}Rg=KgAKF|%EmjAs%7JKW{HYR+oX z@Qf|03_esEO_JgMQNo)e)kIRD(IozPoBbaz^yIVvWv*c&bdr1^85h}R=;88yI7+Sr zYjXtmfCn&)%2N1o$dlxt2SY_6(_ts;2!ZFTw+t7Y#964TAYpcQGa8|Ez5AwdS9G5F z+((j-Y)>s4CK7qz{O8BdBKQg-;83un>GMfA8X*FzTS8Y;RgrN&!6{5|nZ3hG$nuVF z)0;7wuSRn9xM?FkKX6wx>`sHN3fN)J&@KF1v^OZ?yxyir=%?WmY=`L9%*?8l1Bu^k z$S6cwk*R$2s*EiJg`SokmC}+=vFjXbU4e7tjdMPfPRNwyEIS*!n^u{u7+5o^BCqT6 zHzwl1*12<$v3y|XEWUM#4t=;^)AX;abhf6rTY$0l&P-_wOl5wq;H0>nq<6_}K4s0q z^F?K{DoLWW04+6Ym~T;)d(lrd%wJqIPx|hawcGp)NOd6Qv^&MZ4#Lq%RY=ZBquQ-2 z{WxK^c;`NUAKf~T5Q$Dl?I{T(ymCkRDrep+z!>Lf@%*%k-^IfpRIptx+P;c%=EBhU zrIg>{FJo&y3nBR^(XwhsJbe^gd;G$)KJU4MhD-wH-#SRdsrPmedktBvaJ6`#vm%`# zCl%C{w-UHiuhunZU6v=luGX1xdSZbd^tFZ_XKyt`rjH;Ec;7KK|v(PXH?g`?q%kn(_| zI@7T+X|ycgA>@T)9~)DznTRCQsDhz2h`5j#hi4HfxHSQBM;SpQwm!+s8b~d1` zNw1lJn-%sZZ_LU~m@jk&LJO-&X*#~vs)3XHLOO~r`AT^P8Lyc=*FXAQOwS~?S5JQP zt?%b2(e@{Ytd{FV#?*|LQBl>H;B&KKr-qVcMjeZMn6r484XslO(h0g+{}EJnIV@U3 z%V5g;Rr%s4*Zc&$-xIVe!a~sA0H#LL_&LZ~m%=-IwFQst=x|6yItttL2 z%eta&O);Zq8Ey7?euN2iB-6dsI^sU89Ilro_E%!wZaU3Tab#I>U)RUsL`EK79!6Ok zOI|+-f=aA&u`K@DI{%lD+Pm~P5?$(IIl$3TPtfR{NMRXpp}5GH&Rt)cKCq>pNq19Q zd_wX?$1E!&hs4Ah$xi1pCFulDXlmqP2pHg`r%{V&Eevko{kmvR0U=pzvvI=5<;S8IfthfuMC?%8b%v^6_9fof^*!O@3LGI{42BPnF7cu!Zh7wqs!&Oz;I$+FsGYIcyiJa9HF=q8&VPi!C!dSWfp#M7?92 zg+*f_8Hjfz_&lW4%CHU%X$FzXPj(xy#i`a7%zJT8h7%mFKtCh=t=T237&*DfLu9M0 z9-oUrlbrDFaF5ioreZIV)P$T2ELsCa{mbmV*U9CwXKe7KI@@uF}=G_R@qyd(R zYm}*|r~VbZ+v|`5f~fTa&xaTJ`x{FbR8_ZXlE)CGB1CuV`RE1P5KU{{ismicC!Lkq z!f~M_CF-A<6tcp~(o6%vb*5Nb++>_>9-bgi5}YZJwrX`f=e%2_d3nVII1nkQu%A|P zrNd>t%Rpki(k$j`sbm`1R9ncu4KH3&QMMji#N=!EBH~JLD&htwl=-FjTMDxE5K8C> z)E}D^da2KbA!=_r zaz6`Ibr-0z<}1r~uBX_ol~TlyN=#}+NnWpgDaCzeq&fDBX`^JdKI>{EPU7<2cMXn2 zPgD;dYA|R3#pAToM(`|noQ4Bvotm${}CS2L?dB`Tlru27!eilj(_(wxDTo1^dz9F{cG9Lq}IHQ3dqGS*Y%Hg@U%r99o zdD|sg=@a`*QX=%-0?rbSuLwox1 z^swhG5BlUXk9RchdTw1$0?xO$v#VR-t2rcu4xDzKU(}TBVsRFgvrBJkZs@*@z4K|H zSU6S&FDy@$i57XDrOI)~n~Ch5X;__?+l^I+n&eoNh95mEo0_WPJ=v{iU!!ffoC>EV zv$ZYO6NnL;;1yt)?Z)YXW%-AX- zn%;$*0pdpoN0q~k=a#tF#F;(lv|?Jw1Xep05o&b$b~u;i!1;cOVg0y-b??TB)}L*& zjQ)|TBEThwir^0LWQTup8->#MG&AG#C{c6pyT@|o?ELOI+cNid37DW)BLPZaqQ|Tg z+FxvGNBhjjhSh*iJ!j2v)rgZ6&Nl>hTMj}~qZ)|QI?^y;N||z9T*POY&hvHiR4i8a zwb0L*oY=l)_Ht&@L8Hem{i=0@iGgW~NqPFHyI-2Kn_rZ^z1ZB0SUJupSIZWg7VKke zJCVp2J;$;ugD&kbJ`#gT98ZjP&D~c7Fcw3QEw>ZFrS?|K;qT0bVI{th2w~4T93l1Es^iiX;3$AsZ6oZoX2`Q%*HL=SC zM+lvBal4j%OKa;%8!f(W6>gT}VFe{Lua~7`T<>Omjp)%1xvE@E*(7%HeDZnF?572G z+Wv5vBf(pY8%RN!X9iiu-yS`&T;9Ttg2kQ96XY~>ld8+S50`j`)VH(|k$mh;8x4M= z#8bTum3K6sDSB{1cIcvNJA5q!pVvtVeEl(fJ2nG~q`6X&)v02;s;2~W2{d2Zz0pPD zPgv_P;FMyDs|Ce#dOLWbl_M}%nuGJU*A|+pNayP=O3xxxOCbg@gS2p!Gbx6kwY0pC z%LV5u)hbmb+Q2~;I<3JrSKyaSNF1HD@+MPiE_ezvo`3WeSuG%m$x@c#Bq zGO}1+SiM6|HV4S~Rjv2@=J``#U-4J!nl*f0$tqlWX^j_r_T}ompu*hs;)VM`LU4>;`V3)~_o zbOm?gcNa1uhPG0zDkx0N8QltHs#hA7^O1{1sE>G|Vb0}_eudRgDfTSfL#D%ICifVK z>&X<#?4{y?%A4-o7x13y8_M!m*>wq^Y5mV9(hHl2K`$#oGz*9cUgEe~E_e|s_9n6E zF9qpk>cGN2BNB8IpLG(nCoyP5ow^|Y^SJsfQp_Wp3U`b4juWr(>dRV2`JFurB?pe8 z#jJXklIE|=3}@#j3X}}$N-2_yEeI5f|paKZ~J&|8VCEGn+DL6wqh$N3DU%fgvo z?kr~AEnkkd2~UtQ$7jWTKUvQFV5krZ&%o1qiJph4va?i8Bo}MwU~ljlJ@5Y%yp&<4 zccMxq6Tliz#z!`3I#b z(VTX86h@AjjTzOnvHBV@1C1FICVu+LiT@g=;73+>fFn)`aX?NXRjAHQ*QC@qr$fx@ zz7uv7rD55z&-EhJZ82f8&l@6Ka>hF>`yv9HIALFIZ({e>LLD)J+tR3&P*sOW zcxKbK_)YNB%IT&naaz%POK|!pued+ceav8_UzTbLk0OO$Mpcs)w{~&69>t?!4wc*R zD4k%sLXe$3a*Vm+BofTpAD|0So|`EeSGR4g{(ivX%BJY~j!^GFwu1-_iOt);gwppZ zAtyZ{p&%^T0U{@`fbv(jq<0iq*#h^+u`j5ClndCf<5;?=dCnMd4JBssD9SqR^{HPi zabH#?OSCcwX>k$#C?#_;a*bX_Uh(=?=tR;dvvN=RITYh6(dx1`2<&n!W(yncxic;# z($pGcpS@V2sGXWkW987}4h;zu6G@KlA9x`|UFGL>ZJ>8*Wq2pzfJbcw**sRl`1cL4 zn&oLF&BsV0?fo08mEB(g_nXenH9#74sLb?zJb^6Q6quwymV0gqHs|n30+IPT0bS&s zs1aUMsVZJ5<@7}D%6KpmDm+$bJZ^r}I?<`dCr{lA2V5}VpB8+KPHn1o!-JXf;qVCI z$wy~FpoPDYJ>1KhEK^O8$RiW8dJW7n6k1e4+)q`~4k@iRFPCJn^BTy;JcZoJxYKPn z_z>iruXOV%tfx;C+3VZtP|8j*gP#W9q)iUXU`F0A)|$IhbcTuaAW>uS0V&TyI|r>m z2;Wr0p1!Ddq0V(y(2(>~DM~iaR>uiCagJ=xv!wN7HA)91#ZIvoL3?t7^6m4w37Ak; z6z6coHl#xiZU2#NY3V|+^OxEKa+d*3wF$%`<>GQa6@yN)np}A)G`s^}COfhUgImD?Wgfjm0l$0l-k8)H`)4#yeAmY|3UNbP- z`)nMOld<8)c>tzfIilT|!%$bkY8`bSxK?q6HdC`koMv1`LJ6-Hr!vcuxG(ceKYuM( zB=_||Kei6g)ksWbVbDlQyy7)RX~EI!Jz^a{x^0uKPpNF<81DMM0Qbxp zegM>-K+hBTapacMOpa!F{u#9uKWM|ie4jj|G>qapy=)(60fGUAFrv`cq`x}8B&>aW zPv1|5EakS0mJV-$FOZ^m=G6(FY*3k}B_`(3qM6hbvz1DadN)kO`f8kjXjfV67N%tX zflrSUqf#NX!!hplVqC$WwdiDpdf22F{pNGJ)kWh|R4sPaI;1Iy6G|#QMK-5wnTf%J z8E=y}<29nd@;!x+qhVF#f5MzXw`<&Xec#jKa7tVdMC^1w5+G0IRg1X*cuFrhspiOj z2wZp&p5R+r*HT49-ext)22M`1V^9?S$*L-%c99j*<;Zr8~XWk<+s77s2v}U zK65gN*96Y4uP3E(J2M?-uZia6&@(BLt$fZAF32vHnX~Ii&yvhK6d}yP^@X$NtrF$o zJ%Ua}LUy@WP_F)HT&-olR)Uv(-k*YLckT@RVGWSa>P}n=nPlZAB1EOo(LAyIhDsNy zSUIVAWwBv(%5EDqBz%dGco5Xna&w*5WE7>8*xZwg+M+kS664eG`;Zv~s4(hF5+};+ zk2!7|#%ShDjJyyBF(RJlVsL8e zD)@LZ+jP$B)ad0vScj9;a793jF;W*d&*AV7@z++U-63r6I{YTKde4LKl~}gF@XW$A zU^s71N5KS|JaTF2?B8yQJ8SE-hsGT9evDBr zGtxGNvNv@2c@T~?*fE&fDa3Pm-xPj8=%vS7FLXp`z$&p!f16s!@2zwW&z0YrEwzk; zqC7w4c1P1OGN{qr{cdHT4KE@dY%E;@x(y-*`o64&t56m7czv(EV~^S99uQrb@j*_Y zm8B_{Il^nFyywZs;?wZG8}6dWvL=K%$^<1MDA=aY(E09pcYOVQ6neL{Cf-ixQxwl> zN?W@4s255ljv*@^GrvQ#&oJpuV*&+oaAa}qncr}zFLxA4Ov_;LJt*9;x(-i-H{odO zbc+lmk2&awE~ehVHRBEwa>UDcJtrw&R2?ZzhwE!)hFd9u6GGfk!EqHkOU1fAkP^*( zNne_D)MSU&(M+arIlaSt=}RlBF0OZ3X>;6_D1Xjm92=I2k9Eu13qY9{$L2W&;XIoT ztT3O)vSXwNPP31AVt?hPr+?1xxI&Zr)XK)l%N;TnEjc-{!wW5jua_aWhgL#;0^yL4 zKFgJ?$B)r5aYLLIm1sU0d0Zd4&cs<}-on5pXeYS0FpmJzAJg>M0vCUVgf7W+4N4;cwu%u&1 zwtuPHnPpcsT%jH1sN6Or4BcQ`SG27IS!#jcBGpv%#&Rb|F(b2>$7X++|C@IcChy4N z$SCgENp-y;PhG04-Z&d(7-MK>4xKFWwi(=9Y}PAZ&GM0zedKE(E0({*cf$iM&9C0x zs;d;kWM>tW@vhEt)8C7=PaOV?C?<4Ne#s=3-smAsNLO56U3^&#$j7T;gkO)EbBMBY z=?F6a9I|;D`x@Q&NMLPJL$&Gf_{4AFBK}k+>SjHkKE8WXMbk28*}_ZEGnLhoU|tSM z7(K{W#kr6O;%#0e71w@U$4jn}b>YfHrd+7T)u>ux<2nWp4r`-db`$TXJoR*7_fIrr zCvG}5S=&yiaFwLzdAOkTR3?`!t0MJ+E2fgFB23_goh;49YH>0>b(dl=>$+J&FgD7q zWbeO8!3M+@0xRa$(lD01(p_9sg3m8>1S%C2uBKei2tF#Dp32}+QQ1x?D>M^*##%N} z*LvYVbht|_w)&umq3CzGItuX;|6S@7rIGD;Lz!0kbhS)6K_{Ne?_~eH;_K-c0}ZXV zHm1*{rm?K;7d*BTZCQ}!M33IH@*?L!#n~LY+Qr$|Ki88x5^VtOOiTiwC-r}80TWCv zncXG+xxz@M5dmM>xLb*Xn1DC>08(8xyhiyJ8#Mbe*Sq~0=MoujCC=V;< z@+cvEg5x&?WIo7m0Mr&YVY^x^n2p)UaU`TF)8H}t38eKZP5mvrIP;y?Hwz5c?p!mYj>(vfkTi8!A1c}^E+Le|HY)F&|P)ks21 z^R`Vvmj<5`yi=p2n7TX8)m$cTABwjKCleAAC#9PsVNTb*JTNgN6>D$M6iby%S~I9jeJ@#(U_pEmTe2UuV)TX;U9@$I zML~OMUigoXt&5wT8%U_v{7X)e`PK}M9~VBr;eNZAK|ed6yX)Juq$=ia7)N@u;K2#LeCPI6G^7?U+ zB7petKi+sjl!jpYV2UU&OT$(P2@ZVj*&{PbEPDMooau>sQ?euZiD< z7y~qgz#Gz%N6B{miX4x7|&xEodY$q8|ZWpe*N}n z=6ZzA&?Yp$@Ac3TkF_;2&N`WPUA@lbIoAtl^0eoP1cXrj3Gh=VSh<11a^}u5lZ+%Q z9mpR6N@7AaTxdqZt+Z=VU0Px~M-#nu>{la`;QuJw6ljJei6&REKu~&Dx-6$EBWebA zK~gahLxSb5k?Co9bbUQeyur(EIYFJ=x@y`CpMRT238S-?7&C#RKFS)}w@Tg`cR|^&%$GPjqGMpNty!v^yNH#v}$ZlfwN zYCHg5b%VGmO~A%fZrJn0S`$%msS7)@&(Lt5MIvU-7Uy!=U5S^YNZ>L#VSyf7yK=a4 zcw%IZAXuLbX1iRRa)b$*z+6!kEu#k(k?db2jnk8jd-F%n zx_a+5ye;rD=U^PY2a%g_ZJ}<86O`X9^SrvmXr+N`t$xrXSImtzoDaE4w#K* z6YZIq>*wd0-qn)ifsO)YvTv5<=?9HLY1|2j{A^P~NEiKe4wu(YOd zs8%CKJnlgF)W}pHG;-4^{{B8h?XFV_rU&n1OGel>$y2!XEx9j}?8co7on&VD7e(BO z9zNtV&4OlM0sCtu1Z9;(6KaZ!IA+_v_en*gS%;jVYCI)Qf1;He-|8=3KWqA-4Aq;6*fgbPt zQYC?FOiVnMi9!Jvok;un;KSskT?Ho>NmXs3!tseEm+Dts{9egXdg`RuK>89nY<_ff z$Z7}4r7*uzQGSzOG8MMd&!-a6^z;SDw{Y|B`ZBX;B+v8D1`_fEMq%`ckrFXO()p3ekN_t6d1igRR8-R| zUSBP92V!J-Y|@lru0>)jN!{lptYSE^ju?WanE1@p{iven=gi{b@V+!2x;PmIlbG~% z7aI!6ZBJcgWT~sL_LJ%Ff#^lUV-niQJ5^RQZDur~Lmv4r+i<5)${Mw7>P!ypFYAr? z@8l{#ESnN0eoda`eD@&ip(rJZ;Q2q~PB>$Q_nCNdUOxyyDunDNoN@mAEHTEyi ztHgvKx1H}rIjq}ddbk}K|)1vLZjbFKC6p_M-k+@_VDnI%jJ z>k6H9z%+(%hX@o76`olWk&_1F<4>5<)=GryY|pSGwvimfmrA~_ihChaSQ)4oFo0wx z9aF`0!9BCB5wUL)UU4Nc_I>e^_y=Le!tzEHVg4DCl}dhpUbW>Cu8v->G0~|FzpW8D zDYTgQd@lA8jpElyn?n~LvL-unD+T0sOo*k8~nhgb{6?66~rgU43g<3)?KUfR9CKbjsqTrSV;S!ZF=o|<+u}u$s1pFF!fyiK|4iet7Q=*ei zF4w-eO^tR*6C(gp&lxp>CU|p+ZH4JW`NB0F9g9qH@N0xiE`S@HGtq$~()5)QS*f$r zdfp;f!(+0zmn^PJ7A0iQ=Bx0hENuQqv#zTf$XB_fdPUoNi;{1He2aqOnNq!Yf=VD^ z^BdTb&(6j1U@HPBv(2o&*fP3@}9Lh48Z zu?i_WB`Cf2C?tBZA#(j|J*5LysH7Mo-1>u|c7za_e`^6H2(lN-Vh$z|RD%{JJqJSV ziu%bqJ#!UPx(o4z6DDLV`)Guilw_`1$nq@ko&G9CMfT5R%iWlO+S0D&Z90Vvi?UTR zdMW;<9LSK`TUC5xD_e2*?dYQwG2Q(BeJ7{-3GMH|UnQ&BqV=beLloXgapZfFPkSkb7TX4XGl`$fQeFOF9~S z)pO2h+FH5SI9)djJr(6yY+2-3(=7Gxr=rfTP52Tl&0Z+#SRHv~t=;3Xt|gP{x1KN0 z=YCN|_)FqP36R+#`ER?m=~Smg4%AOE2!t2H!WV|kNxk@0UVnH+i45IF={|bo>-g;E zDLT&m(L(^V;c_gPoH#;no&vUDS0zqHY9G6z`yzT75*KBjfLN8RlChGV>6#HQ3ey5S zAvfgJ__gxxrzPgw6~~njF~Yuz5U^R{tfb|T9Fd-(VtJpQMTFWG;pje|XG&8~Fh;f_ zs7;;rfLfly2@80;o3=07X`Kn;Nsidaia%Hmk#*$j;BE?_h@tjwNR_`OO}mR#^Kx!h zU>Z<9(WUg}EuJ5-Y89tbsYq3LCnK(|WTeD!}na?HbF;xK=iit9q%$^So3x z4|fc#XgI;ny!9*=c_%E_8Q8BFc`2t}jOsGH&8G3hLUy;gY_v{=UGE0ndmDjMZVxQf z+1KHfE+xEDC}Kv6$#^&&zgEn1-p<8`a&}iN`0A_JZ5kG93*hQj6c(q6Ab$mh>To-^ z&6s$yeC=J8zJLM|FGZt=_bX~XGL%Hb3KXcR*h40$Ot2IfUL3mg)n++a?kszlsmxZ} zBNc5jtDhmUVortKXG9z@3Gq-XX*rH;L~x_Y4^WFz2IaqHz{43RvGk<3eBSeql-~%L;sC8svBhI0C`~7Vi%5?zHJ#o)N@sCn z5EDB)@^PRgt2cJ=;xz5DXIY-^lWD>O2-~~J%?lH=y-!wjj?y+fUMU--bvejqOuCAR zq&H4J@l-S^3F7m9drx~%u2S4z?Xg+CRS0=A3ZOu00K~OWgH_5wNno_jB zJ{wzBDydEE(Y;4>Pe_5@K8@0hVZ@4-D8?yTTl+zavvG1Fxw%`4(HsKMX<>y>Bac(! z)P`XGV?;T*u2Rk3!_{RL-N$(qm^H@d3tZ}&0=s$M0?oC#lDir{w!#c0jvYK{yeCXG ze$0LLD^uvY`ne4Zlz$A@Z&uPR9T1Q4ls|T`31U6i-ALD0u2H}9puo&tx~n?+L9V{$ zrloz9sc3d_f9BjWlLmR*0+=Go`@4?)N%ZUJAFn4L$dSLy&-a)w+$_KBMMG`b0K1KB6)J z08`&w-2JF`{p~%*Ua##2*Hr;r^{{Np_i_Q9@)HQKy)D5-gBiK?vdGD(5A@(_uK~V4 z7uWn=`pW(7(uXAtHaMW?iKLpdaC|s|M&Cl5QrQb zdIuJO3<@G$v+MlRg$L^TeGnK_pm$f{^srFl_f{m|O-6`Q2mlZwN|p?Fqp$4ESddA~ z>A&A}uPj~azpgInd!3LA3UEPuhgm=tPaD6MAQPIqBl_L*-m6$sg9h(7Z}@umwc~E! z+q1T~F&Y%W!GjBg@r}B^RpV`CYV*u7Wyvcz~PAm^#nnGS)A)sS3iV(j%YMU zNDv;dT^lSk9tyluxmqik!wC@tUtQl2lMF>ej6-7#sj~0S+rU&O1i+hs(O4Hl3qHOG zxIx#lJ=ZCL5hl1_{-?d@lbUJEB|D~L&y9B}?7g97-~La?n+*x9$%KM%`SK|j0C)*= zftx{r1Z*8&5dps`_zQgElmR~y-zi6gWhRGHO~>rGFS@M0Q&?ilUX{kj$#F(CaocV_q>E-$i z6^AdMT>?i2#VS@B%f3h_+c(lxV8G5M?hP=^`kP=EcP0r7q0S(Se&7^KK$&HndBJ$LzUjojutJU(4bBBRCn>EB5@gUJH7oNy3Pd#+#{Hm| z$n$^(`0g%Vbb`nvyR;TV)|3$;*W)$J(d@q*yKzfqeIq?KvjPblDN`LU%mj>wWWY3Y zSPatF#W4fijjDJ%F;gZ#{wxmVJ{qUL@90Z($AtW0uwZMA_U@)fP`e{K5It$o-`ocP z+(~cC<&ykyAlR1iDYGU(wFBLHTmDgy_ZYCu0dL*ofbD)>LJPu&)j)U8ouoTCv zpycUHSrbS6J^3QGBn*5a{&8)~R#8UxNt!_=``@E^&pq0C))B7yHUba`mYbo|rZ zN1gV6qV0bN(~;tT___1?JY~K0G?=68I}L6KLxFO`zI*Kt_de&GeV+aGee#aX`A!+*|C?jZ*|G0^ak$iR&_|nfTa0%u4vJlV zyR+%smyeV?@T2AECLb=f9nR`&=g=`EM9FF3CbR=5RlxE`Gv5B%tfuY3^=ZDFF~;jV z4cfpU$2xYFCy^|G039HmX!fv@d`rm1A>;2KojtmVccsH4vDxYwR$=Su#)+)T0bxnF zk3iC665Q2#ZXA9R-*r8AqfS3jeLaiHySXY?y|n`X(ixV22*1c!I?wKsxb6hcmdph-Z(w+E2Pw73cSx53Y0hqftHga7R$2z{XSj{ zIJ4zIyXhRtV)c@_9eTZ6d5R;4j_l+DgAndXnwidihqm2Woih5fAwdb&&64`U^JI^m zYFkpD*d*oi=%=H4X!Xh(V|XY2 z1m1-7!Lqm(8=L+h$*}5_Zul&hY{{lXBRoyvTinsMd=gIY)1sThYnZ{~VaNA-O!%T% zKm0N%f7Ys7X(Wf5)@GtK4|lg|PI2ch=mhH?cm#UtA96Khs=E{ymMx`%)ZbE&Tjo$V zPWu&%Z#d(Lt9vx*Dka%$w!TB}0x-ne`|zn@M-XP~Ye0dFPi2`@u*d|%o$xv299v9x zth9Bq_$VWwbyM40sYO?T(<&!D8?G>3h_wpiP?`n{GL8Q{tz zYdeTW*Qv9ysHF@f9o4q-`V$zwvQ_TUnEA|+m3qI=d($SD6D(utwh0Nbi>x^~Ah7Hb z)c3U0;R$7v^?H*NxPULBfU4+{Ff5Vy5x^w{V=NllqRlZuO9ZBFM0aVx!Vfn<6;b&n29WBNU3NpT68kzw}> zhvF!*t$`Kyg=Wm>T>!Jku&`f(!grKIN(nWbN;Vw@N6i>JiAOLX4d4Q*zGYU7ul{^b z&-DDo+{`thyOh@Hh?h!ZIt5jVT)axi%x0vhBwSiN>yzucI9{yMVxYpKv9)?QA8J?B zQrPsxnscwGvlyKN{Rh0I(7~B9NDz*f6E?6eJ2l?FYGbc{Xd0#x2Ul^Dm3$KB(;7f~ zLH&i{msG`;j;4HIwS~1qw|vE=UcRUF2zEc+l`Zg#zZECUN7{i{Hme8(Ew%>1T2>6koj*HAydQ^ZL8*Qh%<1tQ@Nf4Ve0xLt=|3lRmo z8M>vZt(RqcCmC`gIl3g+`C)$O@$%m8v~C2tCf|?8lc&MTnkR?P zrn=?YuuI^U>FM=^!@Vc+KyG2|2T9t65XrU8Cc?|#gp(34_?M06U-Q>Ub(v?`M;3Jc z9MSNKiLqBmxcmC~arg*zX~1JRxT3W%EsiQ)?k<_3CN=4#;e#ooa&|WGUtDYh?m5tw%#@l{HvjQ$yp%3ZV?F88= zhUREV>6(h;%2R5~32c-tGN<+%SR%$P3sUserV0@oqMo7pW8o#~BHHs?n(@MbVyZ=% z1LOlq0$7w&vflI=zIP2irR}18aA3ZUPFsSRB^?(^RHYRYHXWhA;6_}CHTv#}m`_N_vDc&dr@J+#po zC`8(&p$IBOnB1M5oLUt@IMGI%PsPUnbgV3?radi49{SqDqzO(rnjWmyroAw@S~J1& zZ25?B?NcmBxGq534vcF|#_u?SRX-Y0`VNnAB7xx1G-jAd|tBsH)MIH7vx@Vl~hmE5BQozS|b{c0Thd(n7xWA7I7?B?cZB*w(pVYZh=SMUh+$$MAD}OQ)Z7)D=7+TXW>wql`be^;<$TTvmU-Nbl+YvgLXszo zCA=w--vm9T7b?_kC+4i~n@_unJGw!@ni}vCrxE+Oa-YGV>Ge<5<))mRG>rvuthA@C zg_S}F&fgP`8e5miFZa+o#|sip6=_I}l8RRqq+i2kP?^%{!-ucl@lIoh@kW zi;zd7A-JR+>s*Z(jQ}9UqVBw3F%J(18!dzFsRd+9G=jpe2IR)K1(gz2@J~>%eN3u3 z;de8shm|BxP~0a{YSkA}P&S`vQq&g;;4)SdqNk02Mcw>N{xP%iO2!+{yFUkNPO>)W zV$|i2`O58w8Ddo<{EfZFGD#+A2OFQ+@Taa&=MAVm+#ZsAfQ+Re;LM4I$bM-xGM+KX zVlB35D7k()z;S;R52h`1wBwW)y3q?C@X|B0_wTGy>$8t18TH6Zsqy*8G}CJ<-?%}f zJo~FwGgm2^qj0Kov$j9ldmumUOl=a8COPH+WuWeP-Y3EBiYW^Od|!A7g(oi|>tFJZ zbY4u$p1(QUf49V2`hrubo1XK1-Vl(?28w_&3Cd)p$U!?@Us>+e7)-8xYF<+!8*B@k zd!)3|bL=R>bf-kO)MRDN3OKk(C>n>Rb$=FBH=3#c!cZ>OIbNP_>Yw*X;^c~hvPE*_Zdl$9FamNr^MntTXP=bbZ4Xi z{)V>@tP*>2 zCgKO=T=e;a+y|I~!;uoU13q|FllQ;tFGY*`KQkbiYb%g$oEaEyTg$?pf3Ek@mLW98XLrt@+;MNd(~aA_ly73Cu)idtwxQNNlqZ?0Dg)Zc zV}*lTyHh2L$-0l2N}x>^yY~MiUxcu@A4+^_5PpFkljAg^6fDupjJs|%W;rop0(MNqez{C2QA0XOF!ea7A zI@b|6-o+69*Rm|0(7iXEO8S5RTigk0-y65;HOgdvWy3qpSBhoMT8y>fAVCln0stVg z2W#^Gjj_VwXPa&Nq#z+W#(R&fj2IOt_JS9!LSu@tmD%pZPncGlp*A)@dQ z7JgEFv#LDu8(V69(XSj$1p(ahuK^2xBazF#rJJi?Qu|kDH>Zqdm57Cj(jE$eC{P)3 z=V?QA_%C!`LVqDpxX^`w74YS+WGXpkB>#0vrk0b;asH57^|fU+ZU+*TiE!Fk(sbxZ0uF|&z$th)CpY}De{3S~GqO*#kQ zb&s&X7d1V5uNpJ1j%n0s{v>y zZa=(GvCqUQEcfL1$5H(4vnc2;N?7)E2gP1DFa%isxn9>pnRi1->Lf-KJY{N~A}nJMM{u;Xd$IA?hm4l_N3;dE+5L`3sl9NT*H z70OWk8?ppq`Fi;GgCzfxv;3v!PXzJ*_dV)wOnT_)0q^)xZ#Immd-2Cxrs&5H?lKO| z#^XrSTxEPbU^w#aP(l~#_cOOU%eqlGd#LjlWd>JoibwY&awMhcKlww~E*qg0_LBQjUy_nv_n6}Y z61i~t^Jn}!Da=p~$6tbs=VqkiCSoclHoO4oG8}9D!Y@#9n+NePVEg|JjK8ZvnweLP z>#er~>`tz%+%58bE&F#F{(A)cUs(M2_;Dl-Mt>x>3OUfv;JXgu^Y;z_$vxkLX3!oT z`7B+G+;oOqG=%P+D>RTwKOnl&UCQ{s{CZjE`hf8!nDk|}RfitW2=}1SNptF_AF1p| zdFNm8x3@QpI}fdc=C@VdSOW;?b_zSKZ+SHlHB#cK;zgb8r9KvURK$P1xcu^*+xlYk zY~fH9g8Sw1Z(UgcZea;^Pn(H;2-AD zMe1EzeOo2$RDqWnd>!p)V$Qcl4s~UzEO7ZPo|)b)sl6-GC-<|nFI{AAP{AG%MsNH7 zSYDm74W+w89b13sJ0vQUogPVuGuBn!{s`Lx# zWxhH-<1Q*KYu($W$LsH_-FouIi4%thc+=MApz?KcY}wDBJbB;}tXa8`$&E_1@a|FV z@0nV$Xn--$CpX8s`z``piYy=^q#JZTrEJw;KI!KY6qUmkmfz;G3BM}I!W8MqiBI;T9 zr;Z0uVKXC?yuws5#89;*ewuuh4GT8$GVPA?S$p4|ZiQ%Llx(M!F`XFK z;}^5T~9B3z5k~MN+4GD=$%yZwDyQlwo&=Z7)ff002D4+j|5G1mDyjkzRN^;Tm;pkHK%zW*gNRS|Vh0zD&@-ie|ze3+|&K9I{c0H}cZxEEMQOU9qonmRW_BmsE_&v88q-6<3kF zE`AoJO~jYw9u6^Pl}(sma}EO!4wuWxVeM9_wK%P^!S#{HEmz+a9XDKcO`SfWS68)l z8~hQ7jLm`4v3ceG88`I$+?h!7{_p11umEwy#I7|wqo4p#d|0?=ccg6BKBi+t-*12gYEnNAo_wGs%_oRT*Lxv26|aH%pu9De{QK z`1<0ix|R2T@=uGNafc@wz1mrKy?CxDu7WmPC(lasCMfL#t}qv+Epdt)@dR5M4^B#Q z?)ri!tBThU^X07wn&&{Zgc_661b2~*va%lhwa{-OsN}k7k)FnB!UnGC^aUQUSHhn22d z^eJ_L#i7;E%8`uqIm9lgp5y~D4F8i^qrFM=B1hUff<)W5ipz6~CVi$AViMG#*Xa<2 zJ`lJ_B2Kp4>GRcP+xIH63TtxoOgA1Dn zrLA8@{VE4Tr3MNsGp9{$hEC#LJ8*;x7<$LO2l1AN?2~&g`>Gcf+vpLV#bR=>bKx`! z2}C;R{aL^O8>b#tXMwkTXP6Y4RAdPi!Yvq2Q1lRvZ;U%GeiKP^5N2v*+>XzpPD~y4 zOZCW)>zSK-f zvdfKpbxp31V`9g29>gGp529-;%7AzDD;8uVH9#;ejNPZrNmVbXNo&(M0X2NmT=3vg z@n_~bvuad|0JA5YlSo3Tchkl_4PG#_IOJmHcv)W>eClS}I_tuag^|!2=sef(Lj~C- ziL|w4bdb%)NH>3R>F9xFT9{4HMo{vQ_nu14$t-gLGWpdF2 z*E9Xp({iRDn2AcmtNnyDlum zPHb;f4Ndr2h0Ps37ojWOCad0Jj3SnZ7QF)q`6`%!m1IR|sqLJeYqa%<-=#KVw#)cL z>L?{5^|kKo!;e!gYN6HMe6Y2<7Fr-HF6ohMZBv|WcR#C9I>st5ckhauhX-wIW=}t7 z;bY>VGObwG9&jdOKH}O@GpO2Mq+;fo*1BOSP;+DSip<$nhromJ!QO0HaPIiMy7;+< zC|aMor5ohXD38n!iherrC+$agB9w$^F6uvk5p`?Vg6&`SRwwEGXQ|2J`+@JIpG8Ep zk|jK6twA)-eMGEE|7;Hm))bET@xK0&O6tPKE9Z$*G~*GFi|QtW`AGI zo;G@+R-+CXxqrnL1rjQ8t!_)Xs}U8a48DG#xNsm z%AkIrbyYiu*P^AoUFp#Ez8$t=aFSJ045rSoK0`vOMMAeQQFg>7oPx?pJHL}fbfCwU zuHl(DMA`kCB(bi~wjs>iQ0fNjZCYIDl`KAK9!sX_G;Y(^<|jnHaM(yEpG*jeh+DbU{^?$<)B?1_NJ z*>J~|slwKVn~|~fYv;o=mU~oZAAtm|`-vZlQ%LLb80+o0T7@}cne+|8WiDmq^(5=` zhNAnWJCZD^Crq(lS5x^qx0{9=*E*F+nc4co#KCSsv` zET($nF4PVFX*3rQE=q(sYzH|eTue19MA)N)CyIHp^|`Lci__k~ZB9*`q7*c4x*zRS z)E#dD@jdKzIc%^jH;P;PmQzVrXe6#wCs$`=y+t4YP6X ze!3DR!nsn~kmU|M^Vxb=S=yTZ()j5PN#5Yzl*oU`BWLY5ea_$C0mKX3Q=xxW(ZrSV8rkkMu&qzA=lBKnH z*KyHOVXjKoW!sIPgJN6I$>3u4^B=e77-X>z$q1rOkHi~s8Z#{HxKKPdcyDzSw`bD` zB^K9UeYHY4u?h(Y2=G2M4!>*)FP^FI!m*3vS`^uLTzNrXl&=9ln{X4_ueStqmaWI$ zI6alD5*aivN)zAGk{5=N3cv2y->pvi`7fixioLg6o7DZHF&248K+rC zd-k5%^nyC8e@=+09()ye^879VAqC+V>9>|PdCz5p{&D1y~~O!hAFSMc68+kVlXU zlr!B9{A+$`FcH#=gs9QGUppOcTQ>3-^be`Nl6*JwUkwN-+gLgob&5bvGkq|AZf~3-^T_~foFLw>Fx--hEOu2_OLoMtg#ABy zlEKC*S0zu>zi>2?aD1~m3G@lHyY9z4dN2@3 zBTlZBf#0S-u_!Jr79`N}FU;dMp}TX(SyWO@FR-JI*vn^aWbcnwuGj*8oD)q?3vW?9 zJ`NS}t4*)la1XT7w&V)@IAEU%>}2c+9j|SKu5m*qOsa*9T19)vE=Od0LR;4jGo+0f zBh^+rpphR9K>@F>@n`1I)a>29EhQm2wP8tEOg)^T6*gToW>)v7q{4R{w)kc2-n|F# zdZRGSix!yN)`u+c!LENbre-xP)c}9Kt)DI_m4G_f(K@a1W@QJD*6qWR8Owz;&1MwM z0bI~I?BPDNR2`9k-;9ajtbjU$yi6E!>!i?G*o{nBkUHP!MAH#F3fyjIJQ~L2s3~s- z9rpUWu}^Osu_hw!@tDXQqQc{wgYMlYka*J+-gWoR-(^oo_-sKT!`1AO1?XU_S!`a< zUJp-IVjaPIwwT}(H9^?_k=td~^=vFAU>B=gC)?B}9b>i~TJp!(+={S%4|hU(<{dS# zp>NAo6ll6IQ6Yo>JE<)8A(^`TM0fVD;pOq<39EtUPXmxUi|q6Y&2g7CrqON6%%XM% z!2k?;TNM#*p-#mGn!Bt7*Gv9q(AvZk_7DaLCQz`kk*fGDk&Rm;ke4u_0 ztj`&@H75MLyHhB=tGP7TM35za)w^+m2nr>szxesHiVdZ3oPUyJb7BVu0AxE-)X)hU z?+^=<9Zw59(Pt?Cm9B~p>p&K%gff`tbpk2~-GgLX8PB&cqey_CB-MjYMspDXAosY) zfDHqN8B;r}UNY*kU=p{T?{Zvy+FJM&Yfev|tIQaJ)_ZO5Kg5?iyWP3d@USj#4-rCF zc{aU|51iUZ?H{SsM7M#n0)*uW+uCIIcl}!%LGv~C=-K5#R#--k5#->H8}5pZS@C+e z=M*0>C53N;?^19&x~}t9K8z)^%+@WBJEX>5iTh!C`;#pC5$3VT#KQUo{n8c%$dFg_ zi;qtC>3=*=oV4~eZWXL{1Na&=pPZRNMoj{uo-J89k9~X%-#sN{D%fHWm`@uB+D^jP zaGnOuGjp+4n+RGyE@ht|&lh{@?Q`t=4$wx{qw2(#T_tG5#9T%;;Mja3lJA|v)({Q- z9J_EnA2Ii6oN57%J*^KK{sh7#8MJK)1Is|CE_J)tN3Ho(fhXJ`{MC{OFUp_YNc!mN zf}i1{IdEk=a)uax+|CTxX5Pycv%u}4mG9XAS8USLnblrzMfC@L2lG8|&3h-V3Z&ss zvXx*sjwTnTaSlN}9@V3|Gc(G&O1+iDE-6~>ttsg%rCvh-z_%O7ha={;WEA)$u;@+BsduahDfaoi-t<0GbtJe?qH$37^8tL1ygp z^--_<{5-ZS)-MUp*CnGmK)be?)CvUIrua6=Tm~^Z9*Niq+-;Vcm41o+Q+g8RB5kBJ zh!{faUvlvs+T)_>shp?v8yhP>1pa0WJYh6noXN!jSG|1VxtVx-e~)F}Qo~q^{qeUHcIbx*&DB zo-AvyRb~O?)&pgLy$FV_0#_@1O-_Z1#K{`X&<0(O57n~QvN5q`*1B<$5+?*|I* z!PZReJzlDIu|@T39}Sh3a}9>$;oUbUeB1BU&0^*u9lx&aoY|fXJ5{~1vz61yxP$gL zEQw5o(`+QID484*eE2Cn(xrq~*yoh3I&*GKmsxdsm!=fP?fGl*F0Os(eZfB)1v;~V zuC4(~c&MGnr$zzKmKhPcB$eaUY`V+tm!*Hut(|_Dan*H6 zJ%Y6##A#-^<2qUw_8ytsZB$ZJe3tC%Wm}YNO4=7NS!X{XnIkG0!{;N&JjI#;NME~b zqd+1@H*4cH(>LiwB13B@k9{Em<%#`?UsF5C#zw+YU#8YfU)$v8D-r)08zX;Fzkybx ztxr4ZONG=$*L~iQ0B%8GSo;`V*Luz+6=9Ez*bJ0oHK&&`>z6GjR-r@HzifqkCnXo7 z_p#~}>y(vAklB<;?jhjFPhbXT#V?X;rq^_eezPC5F0v#6uG3L(U%m2+JC(Mol1TX_ z*2~`}e&-HPFdf6Dl<2Us?W9gsmA94If^|{8kYEtWtgT?0kOu?kc>Y14wV^Wk8Xi%} z!H?`@=A?XTyJDHE%ApJO0A&VN<*vE@y~1aY@u&^Nh0VaVOP4|sYPyn1ZtixKuCA-! z%TJe@+{^P_%>P;uO*v!j4_OK9w3zjM>k7D*Gx3|**K+$eCDJOZ#*t0dc5WZ=Meqq_`zd*S+tSXUd08Txagkb<)hL!55AUq(~W+zT@F z46KT7&^m^_xPOHDrZGDxxn*tTq@ieP-LZw?Sl2Lvq`v^#jYO0rB<1MH$wm+{WD0oV zoA+C3+Kc~cOl{uBVs0+i$9XP(f3b39^PDW6X5VSIciyyq%g(qjs3SBws#wo$(%i&A z)-Mn1`pSl5`heYMm0kYRN;P14s{@V_AsgWGauz<_lNKg3_q=uXWMqtzYwiY=`Vxuo zWd4W1_$O-;a0i13&>K>1AZrc6+S0C_JL|oF?o5%j2==SB{`>mY#izTHH7*=Hyj9xf zIb}BVisR8-POk*w#d&+xXfks0pSOk$S@*UGK9dXB5tEZvDlatrb=mu1K>_GaAvO-P z=OSqvga7r?H9rZVYixDGyU0KN!n-(Ys8AkF7xAO><9kG*e~xX42-=phQFN+Q)Z5O; zsGb8Lly9S?{Q|Kf0)i zH0=r%x#ZO79{s9O(p^uv7V$tw;*W@z=130{o=Q@hjIPmJzTPsym^k*8K9iBjWZ-+@ z*%17|=8**yn#)jo!v1*Y`p=DL3<0S^xsOlPqJ7MW z3KT=Z%|P4JrQU2t{04U5T=J~VE$lXktx7D>(yLsQ+r%i>*ns@}8ox!;=_uE1Hc)4Z z(Y9D4#`d`@nsUW!kn|K2-N7PiY3d{&wFWpV$_c$1eANQI7!DbwD%}1|m()#4w3~&3 zHy-g_hl}f*^;E=xuuYa(Iv|Q+sNREqu zyR7WW9|C?E5^sCuR@(kpQ7|f96nmZK3(h%YG^m z=6YZ2P~F_ljV(|HR5!qyIyiZD%8=gp;%9v_OHWq*>HWJ_7q+J&vqtXTxo~de?F4C-MrPrMUDx$yBTkvg%Wd@Z&sPvxpm`dltpB z>kyylIl07!)_+gSfKO^OjRe4kjbx~}Xs@a)_KaOwgN?`wm1&phWk%RZMClgw?Ct~8p_=1KqEwH5`LIw`eI}S`f zm(@zG^cR9xt%yZf%5%dX50oyqv~ z%j|BQUHDcfE+0DbrCz%Q1bAos#C&AS$`p6wpm-F!mMuUn*elZeiVe5Ngqr~=-c$3{ z_UHv*GzBdz7(cYnz_0jvq_XjQEAl}XxhC|Khj=g4CJI-v%)b9v+E`9N2v?@%a1IA2 zoTlS{XbY2PQtGbJ-hwGMdoq=izNa~g4du3K*wd3q#5(i6;sEdcCUj|FV9?`#5%8}a z&ioC#b+d9;OF;>1Zm^_kp{GMWK|?w;7%_`yMr?;`s+x9yZCgQx$qR{vZoTZ7P+}`4 z*77J2+wmNlt<6}>PxRZ6Dea3+VHQex!5d)YJRtY+jE&&)aMi@@yq4Z4(y7~1^=3R^ z>@{;gsgdZ^lKl{;`4K6e+i6(&`mBO*<~gBRm1uuYQOVV2vMMuvrCuVvPT+3i4b4iM{9Yj3KQ?2M$$9d+757`=LJQ}zRg-?(@wd?w%w1Hg z-CmVqnhfn6F@<7-@x=>jgw>mPDa(zN{~EBfBV7E6W-OGF?Av_z7S?c!m;BCHdkCab zwY4LQA^)n4zx|_R&%id5BX{BLYy8vym=a&;%iH!?!T(0!=)WKaMG;YNI2!Qop^Y|Zx&Mbbqb|*?>2M{+fNXGVNf0;tmWyD;k?IdRk#} zbR401yHgEuHP%L(+)!+ckGXM00qs(5GULSsy7iw%KJ_G0xl8M)__BYs=JLH3dZT=!%>0MK-#l6SPE1 z0Q~Saryl5+JB{W4o-NY5xNmQ_Dlg1yq+gZmdk=}3W0&wCHC!X7zsH+=T`U&EjPi9p ztH)o>!80_>)ccs_0#<@}GRB}5#aCshWfpp6_*j_d4NmE*=UnAlH{agc49AZ;yWjiq z1)Ay7wk67*wK#T=t*!dXiH~ ztY=jp=eY6x_i;OGfedjenOf3fVjItWltbq_2>ngKc3?ZZFR3?+`+K6L-R&xP~tYUX`HBzP$U3L28Rgrj`(J~{`UDud^7?=ad`XB&v1^G0?WF76~}Q}7ofr|L}YW=Cb8mW%CZ z#9=;L#?4M&%rVM-)MdC2KDv?*s_!YS2*S2n$P_y#N?im6I%wg9kj@_Kz|CMGD73Yr z^(xcC+ub7+=-|7QW#R8`R-EeVA6<8aQI_iSaB0B+PF!W+xQI}kGwR$geOb~6T<@_l zXcgGkA!la_Gyqac^Hv0ITyEPZz?Q^FTJy@6sI=scNn!moDOWJLfU{7OacZjR!=QQm z@}gS-X2xeRuri+Y`#yFC)vC$h=RMb?L#x&h2Ze}PfU!WQJ}U#`SS{IVn7ND$R@5W} zdSLomLWUk>j{k!^ZA@TaoIKw_xug%7;9B|d*n0CUr$U=4xw8&NeElk|!RcxQYI^K2 zQxu_ZBq3FL2@Jvwb1Ng0`lvn3+hjji-2l|TCoa^vfU3mnLE9Tjb7-ehnykyI{TR9P zW32m<$fes_#TL(jW&^N(yqkOThJ z7r6!~X|Z9amffNK*19zV{>5?zGrN^_9S@Vx-^DT(UM5&H!_4H9>4j}*rp0Q@y?<}C zuzVIcHaU*Irk4Vr4v1#sQsF@gu!~;^SX920|9qVnsTf;=(cg|__{qWo{oO#YU4FIO z(R%;qR}+V`sB6WIIx2Jj5}hbQU^H%1s-pB6+ZT`Kj+a|AXSs}C1d>vTg6W}S8wQf~ ztq1)UTqg{zM{(>lD95=Krm65}^YEafWDuyjzV&=Qd1BibyfW#9y*%};nz|l}@aT&~ zV~5hEq~2XKqo%9EP5J+M3emY7tA^&neFK4^ZA*<*^+}xMj_5kr07~Z7i-$K~Ts?j2 zA9Ko4$o|?fKj~(%dJGt}*DGE8EC4)$aB*B+JqeKiWADg}*m;S3qT> zs&=290Sge|n@SyJC7ZrGTp*nx}Lhetr3S(u}N)U|(j-{Q#mWfkKMzW7U;obF2b zym`I9w{XF0QpYtkbQO?3Q#OTms!rkt*#!^P^mxF&)i*GsK)8yD0nO@rB6Dq5c{F;1 zSgcLRG?$ndf-+wk4#sW4buVLF_I9sv&2sZL>|(LQM=nTwmyc9O=W3nP0tPky&;h|; zxz+dig@4T6v`U>!%UUW7^@}sHt-`O4zZmJWo_^xo>QtWCN3^n`{N{}~$nE=L#?Eun z9o$~M0|qWfrINHNsaxn6uu6;E!y%4P;A*PO8-Mt@6qEX0D5$3`di4p0;QR%~&ys)k1<@IPf5Mvb_6qM!@Byvh&w4*jwg&UYE{tF)TlBUC5rXxARW zKMU^TnUNg*n#d^OvGikAWxX(4AuWkB?Xy8O%ijxIlyx%|W3W*O1&@rfiA`F>ktMj%4C;ooo{4Z`BlRSKoAXsgQ|<9<~)8Xf?dzw>hA zaFDWOFbOf5di`G1Lf1bk`@nQskexPeyDJTGG0H8=p;RI44`hJa`RzWas6YL#=mECd z`kE-VSh>I1J1BqMv|;W$YL^CLZN~LcWwivJ8qV`xj?eyt;lkkf$qw{-&)ToTLZRPC znT}-c8)GreA8$fFPpDt(N@f`G*;^>|6ad{*l>jbk*i8I<`RL2%c;a!xPd>6&y&auH zgc;2%EMl@#46u33U>(FjYS6^|s>eyxUH)JH)7plt09AT#2!5P2s4U1sOAGV$vjd$g z+u(QE6GJBpzr!SWeeEL=Qn|*peo|G6hQ47m7{ zY~t-H4Z0j`ZK!L-WX&Z85rJ7}S5dLeMv;uye+J}AuMWk=8?3x#FEVs9sSnPbuv3Z1 zZjkrBm)uFzYApda3KdYS9r%-C?AX8L_X@(^C@ZUW#qVPxEKx{j z*u7>8@M1w$Gb!wbiGhq_9iGoz@4|75ZNUbXX+#-O_Yp^;8;jSo&W~?N*9O(%iOCO= z-(kGU{`1$)F+tAnE}v`lxPXsgav&VAPs$|>y1;9zN_uhLqwJg z2;W@@zaCrQWo*0$93OIL-is#nx!Qrtfu|Pu2LpW)Fnl|K*b4YbuEqZDW)^z0bT zL=1nq5`*uM-KW}1uefz>R8fCo-~4T|Qf0&)HltiVAYsFYK{ChZG5*@BH&Om)*55u3 z=2YuxK>SwfPAqHJj}Iad!^p8Nr($v_sw2BJrfh0S9n%92!4GY9gC-%bWiu%Xa@y zCR}Hqt>(6`#mE19=KOue`mg`O0{%ZNdKPv{Y>Q_t-QN9Qcvix6d|H$7JuzWUmfne+ z>G{$AlcZ+|vgT-VcLM{eo-63Xw%2w~j}X#E1XC*uEnEWurZ=-0P**FL>Q6M8FjTmZ zY`)CJ3@QmeD&6aUCM9(#-J%X52mCUaP1R~9-6stb>{?tt+$>l&sQX%WCBoV$dT-#p z0!8jp?0y0hvdI61I(TB%Ylh|T#U^RrMt=+Igh;(2=(PE*fR_=h&)gFfCo}MSSYf@8 zO_TUIEA1V_FVWKS@}?hap-r=M>^5gTe~T7t1S3*urq4zWp8MIX9ifONhJDJqdJ@oI z`%0Qyn|@#zo%Rn+&-gzX#FUQ;Uuh56dM-B8l1BUg@Xb8MyVL3|p3Rl^(=Q(^?JYf# zTinlXKTH)XYO>C`{CzM!e<`xRRlE1vU&YAC2r@JHzNG?v7D!%+(>PSpgumS zKfCN0xHKWXb0>>`;0a>&7jhz1PgfU8yNSt&3qxdpK(Z?yCpE0 z`3?D*C^#Q);SJJ@%C9(z!KHRU6ruf9CdcF}UnQIWd=l$C7Y}qM7L;4`_&LYOI+e8; zkA6>-XOuq^GIIZ^J+>2hE(7e1`YE(AWssEewp{KQn}`x4%c4&4n@g?-@+-4R)8`(R zRh7iwA4{FDDk(W0?qT%0U$i5Vw1!seT*tkSyxD%9A;IrLA~wDkmq+&fF31g%==iz* zBd?V}_HM;iiTZ*vj;X=nF8$d z*==DI37d18_SDvgN30eYvk~=80qvi1wGXKG+O;~V5RsmA_p)9V34oWV(SGC3c($wju+R6 zr0WaHFrFyV1L}ajm$QPPw-P(Sg_(?fzV5Y1 zGjqh*VPx0uUx_;Z?BH$BzcNQD%jta;2E5{xPNhiKi_cFqc%Z4p*^IvQ6$e>;Dt8hW z_Fo`^+_`h$S8LjJAKWq~QqEo0l3P;s{alKG&Dx`nej>QZZR$&IXb@_Hx$%ZF7cuoj zmtCt(aMQaXp90nyvQ~>6d61LbShh};5FVo3MD|g7f|vaSp=1<^b#|28?&N=7<3ApjD>C%O%6V%IG&S{`rOuFO*{vy$GYq?t62 zw&)b^6P;z&PFEKdkF6X<=ve+1WB9~#f2;bgVRUqi!pv75fC{V&3M0Y>E=Lu8;(X(( z*hEKt5)-L;K%lIBVfiIv)VQi@bz~34xGVV#+0DCPAql>XoyyK1~%;UWodCTfp;)*SC|r>No)S*1qMb}V&3?{hXBtq$1=~( zkY@Z}8u(8J>a2s~AhKooj)i`Hd5;*NuQg7WHI*~94O1R}Jp6hJ6dJ=oM@i4k%{?T< z9%?x@)Q{pIp_95WPYzv$z-o9-Tm)+VSmvC+7M2BZ%u`fo7_>9qU@e9@Yv`+oEPQ%x&}w5#%SnN-}i(KSn;g6tOD^CMLjZG8^XmxEDy5;Gm_& z5XYm5l|3xIEbT14Q!%6pgq&ME%Ez(wR#w9at2j8bDQ9jfyCBXIaw46tdX9_^3C*$A z0Aij2<9_()d+?qY6v$aM{e(N*rsjjRuu0$x_s9*a#5Woe{p^55u0GZJCqk(-G?_mi zVTK@{-EVUW3;3qQblPNUDlPQP9^52grl zUDwT_^(~r+xh_cS&v-U}3arOFvTdIQk0(foEXP1rH)d19i1>(p9JPphc;)6uv(!u0f&uJ>%~8kX%^Yl>A22e$Hx;Xyv04~b3cHJ;=8){d%i)l2|Y%V zO9oVu(c#L%_D0MdhN{~PX=2vubU;s!%K@a+-G2U69fMLF+pngZRZR5vdbbnKr+W9! zXZ{A-69fNLDs1n0ESW5V+nq<>KaN#^&%x*$M4d(Gdo*Ao4T9O?i}(|3Xy-%G`@z?j zOE5p`RU-Cq8|^KDB+Wo(h^t znbpYi*_0_zU&V|`YIz&?BSJ}`U)%3;cXhVcO@*zgF%hEf=&}D2z`@1cx6J<47?j`P zGwl)Q!y@Ts`6J?keqgZ;>)3?Yug!dt*$8PpOfm;Sh$P+>_l#`Tp|MdtGHW@ktKa@I zcf0Zz!M##z_orL8inXJ(@LfNH`s8puho(n;?j0vb-rV3$R~-W}_MfW!@lX0d8=m_0 zLN)TX&ljKAmF1a6KJp9xXyeqjlMUo5pqe3;?ollFJBLWGp&8NypXp6dmDG2$7y>uQD(m|j+V!ENde$Ac;P%GKz7({%mk(|u1(AV4lsq`S^A0i#A0L!Aw-^!Um z$BHh4u0qP?!Rp7YQx{9oq(CqU<7tl&-{SkW)me^wd+LX7pIGgwt5mC|9j?~2G2Y?` z!vr{is@7Ruz&sLfhMnc#QXy*=6Kjj?CtW&KU(f9u4jP-7>DiGCUydNY0C7Mf~@25B8V7rg$0>tZ)X*-_m9@@ENf)Q18vkCBX~wRuL~nv0=RKnUtbBRoD}iyViV}-vO-^yb0Aax{WT}lEY|VjDa;_>`>#B0W z3oFtsFH^oWr^Y3=?%?%3D1W4Yj~ZF)D|iLsibs~9kdaavvIjS*g(1y1rf;`N#%ueV z6z7)E_@6Au{qN*6WG$8=`(UQ^wX>gIOa-4pk{s&wH%c7Fj58eeZTrP|_P3e@Om5ui z=MM#}18-d_E>r=cLPrYGM=u$n)Vt3y_Z3p-BUjH;i#gjZDl(^L`_X$fk@YoaTD=4H z&u-SKfsj{MT({TVvv)%7B^iAO%@}XvDMqRJS^;>*uIuJL7FS5%-_+~g{J%%33s{Pb z_5DE9<*?kb8-BC%eq4+t z4=Vt`T|H*R#XyJ!T|Cfa_h16_w$;9>e=%UGEjASOxKZ{LxyL$EP{F}zvHRYDHtirP zWA}oKxMz-=H#d_PT2wYvQd%mE4P_g|a`W&oYx;#=%3;2LUllzu!dh@~ds5esG2ZyN zs#RdHzwGuyUfvi!C+?=Qq;#$st=VRRcoEV5Sd=fwxyWQDJR{Cx!B9aqRpYn%UjH1L zH@hz8LP_yf*~CI=#acLJMFeT$M|T^yW4YMsTh`0lkA?0rw)&js#=KQm(bH(n%(s>m z|AQW+B+m~aF=-m50#x&qVbp=Ytly9P9#`-GIbCL|?0HVwLxOLcV+SV9o7+xi)=R(u zUK(Ce!TV_Grb|QQLjYb!L(j-vm`cO0FL9q4a4~|232;+3TC+b=SJFEzxlkj4Ra69? zRqoxDxU6&ZK0K1QgGDOD2x4zJN@q4P*PTYX6)g3q$VkX5$g>%B>+y-L z^zd+9=-sK;9~=gT1a;gK)0dxnP^xK{&6H%)94Z?{=v?GHwh_7slRZ`{Sr8uWLf{ap z4svK)n0UIgIDf|0pz5PY(B1mep15XSn}c8%Kkv7-4c!ozY0#YHTQT`|E&q{rutMbyOSA zDqy-o(Aj5~uLdPwpycvQhiRGzIVO$AWcJ*CAJR=M^cvfw)i8~k>Mzo6%xL}tq#EX@ zP0>Na>1G+An&QV06CH9+7V$r zI)CC7WyuWEJO_6sIoY@~<2s9sAE!U}wsE6KEq1k4eNq_EGP&+*ZHFWgH+hsFOcP~C zY!uRX&_`Wm*sgUb;AQf`vt5i#N3uk4q)PSL(MD{%HNLi>8Ya){pf+XRM;Lz8@~+xu zY+lsp+sw~a9J^t71lb5wMv%Ug;tJ7Pg5)zwp!f0dIqRx+;qPnHtPi-wGHC%49jTL+ zbvGP8&U!<#v_zk_0gBT;(a~^QCTDcv;xWn0EC)VrR9xd8THZYHHH48DcOWdwy1Fr0 zCCPN**|D~RRn!~A;wIsSw#O7b6p2Y?ud4mO<(HLpzIhvn<7B1QRPQUBvD9uSw&LUD z=a&E>4cu~qOlv4^B46roOOJ?ted?ltx~Cg)^0KJ!H_3i{dY2%98ZIrqOwEk+C!o5j z$_5$JW!b#rTUDLD)OceX=?){M+yYcnAW-M zcv94@MxIbH*@Q?*{dKe(2ZeYgR8>ugpxY8#lDd`6?lE}%n~7As3_L*$(7pm?+gU~4|O3~p{`2LOVSv8TV_=g9P&KI9sQcJd-J5NkM?H#_t_q(LGCBDV)k4_ zlYlR2Zj9l#UyZfI`_wg!7^!NYJ_A)@Zrm^AhCTXJvwwB{g*#s|HzI7+xU$}Pdi1sA zqO35PteAE*!9ow#mE{?Nz@Zf8HMwd{V@I|Tl5R5VpS$fmQt&mT77@N93=`klmh}Ej zuY107OWVU!5>n>M?`d;>h#Wu7e6ns_YJv--JmMazjK2hPt zj>9gGq-S(V*pZ2eZibIk zw`%9Z8jB?t7h5d)c%o~y%0#gL2qg5`TH7%V&&}^a!%`w^1FUvSFzQNwrP*6N{g{G2 z;wwMls@N6n97LUv&;67M#X3KXO@Cm<{!_!6066~c;Z@6cs>Iq(S?)CZ&Zjl7lU6VJ z*SM%i8MWQw+Om+rVqUy+qW*W_e-IiBFV^558-=O>&<#5L30vf zWBzJ-Ky~K*TpT#dJvyX`WW&*(Ye*=H*gi^0a(m6P>dB)=k_ll2FDH|H4B1KR3Cdf$ zZ+E(cR&-nCv0tlnx|5KA!UhNGmse8XR3-joVJK7{B1JPfWysO~p!I3@C%svR#2K53 zh@3@x5#8^ibM%sXp0A$!+2(c#E-W^kQGrhPh>W*0y9$m-e!u_KSPTx{oUH~;A!Cl! zg3*lS141mx;{(}Ht4q}M$zu7U>w3vW2%VSo^A*=ci!Amg5?sI(?jG1fG23sXMzs(i z#d3Ce8FbdYAAMZ)%qPisbG1&i+`{gl9`AluUN7~}x^y#k8^P9<0#mXuIN}GNEzX%; zg>Q>+^NEb}itgD|L$lOA2ALZEJR^_zL zH!y9*^Zba1WQQT#9V$~j80Cb?9w~oorQdCB$9#AZF>x z5RSDpFTspij~|U5Z!NZ2r-qWAx4Y%WQ?I*x6P$@S>YdJx2D>C?9XFC>9HZ$K{mNzw zq}SXtA1UPqOr!VgkK!Cd$;geAKSeJFVLlIt^@WC-(L3R~h+fBUy6n^Ia=Qv3s3@ZJ zBgoFxC)=g_=DgjlO&9co(z!WI*Qf=id`NtB+o$lu$v@3TYAj?+-JZRVHkm4L|MGHrH6 z_ClaXECu0#_5IS^u)(O{?{7mpc-CmKV`k>F#?9^a+4M?G)T=g_&{3APjc|qdyfRg| zE3>hFVU*h^u($J)mRX=3(#9}AvD+`L{N(qfer_`(F81@yY=`pcC_qafu!S88Y=0+R+A@d)ajKdye2--OT>! zlKNS;x#$D#?aA^3db#1!QX`AGCk}yl8t+@{ayDIytfXA8Zb33WWfdUHC04Q#{XE>Q z4tW@$j@_Z^Xmg7ZMOA@P#*a66eNgRwHl1$A=GPDoMGgRSjHKv)25Q@3B4IMEiPh>$!^uVcx!PQNqRN{a?p^N@Qrsrw`{(<6lud7yyj3}!JpUD z6m#iEMwCgj`nYS2)t)r6e~_DhBG^BaeIoXSCUm{%S(k(YXHu6XdD}11Lf`vcnIycG z)XbsR-^^#~ntDr=*d~p2os$CO?KwjWlA`l^7&AVo`gFHUkXQ+RKWtkP_@mP_TR?&l zG#s$sd2CeW>N>4PS4za&FId9_^l~e}`9n3rh?IWJKw*1n2yIhsS*m+>@^9qLvi~~I zc^ve9LM+zQ`L2WQgwaLDM#kb}MtP5e^SMjuLaaaJs7H^^>h#=~=}AHEo^H9@Khmg4 zgGSiXAAg^!py2F~oq9c}qgNmrmBd#%rYT*%!|*T^*YuZ3O({{ox?_m!m9i#+jQ6*ybe55jN9}s0nOR>ceNWR|IL&^m zkHdEZm!|IEmqNVnMy3wuNHz*Ccu{$YIQwC$NNPw6C&1)Ebe>b0lmBF2Y_DNx4|0uV zz-%Ko3hN_%R9mf8X!hW&-U7Vq?%R+%v0UadJ^K6AXkL)?%Mz6c!K5je_Scc}z0Vv8 zi!1bg8nrh?zs*fw<43f0lRP9}Nz)}IIhAu%7z$8&VsqmCpDX$WB2s*YsmvOPIage^wO2jOJFiw%F%Q#dv$iz z)g^gA8?=%2;VELQ*5$FxZB>s$?oI9WLsKcP>J~Q;)F;^=&3~K5yC%7MEr`6|=ZH&f z`K7aUJ&{bq9@-=R9}#5(rP!YR5Ryr<+Hb ze+QTUhhXjho&f)E3Q%qP1b?C22ZWF~6jR$gBg-9EyLC@{0O!$PgUJ4SH)|nw4~{~O zj$*X%$KjaIrY<#_J@M$>n*xM_0TaqpwmYsyUsDdiG^B1-9!b!fsB-AHt#G+f#)=e+xwd&EPP-}wBC@FSbBj0EtYq4Z3Bwrxx_UQu(YOMW+^V!T=H4 zKI^@@5pT$7eCK%0xEzC&FlSGnVEnQU@bzg=uST{w|E@M#{g2R}BOQwulY*Q?eH%5= zi?OAps)eI=8q#c7=FyQ#L%fFjZ5>5y4bM^}mryn7vrG^)OLL=83ogWR=8Jrv&kxaYd;;3c&bSuZ72pg+Sh^P1yWooXzpqi7Cl*)WRo@Q!e zMv$4!LmLtFii2)r!%02YD76%28%z2)qENW0FuZv0?oz|gW0@HxRT|brv%(QwcYMnE zpVU-_qJrse#~KG14R-8(K;+1}LU4Tmk-OHHZwod*_NgN;6PjIw1ugi;Ye*k55_Q@R zJNJz}E7WFT%e?p?{fbFBktX|F;0xZ<(l?xb`oa$3Gii2SncpV@TT|BC39Zt)i&W@n zD4M8B!76TzNX7w?>Mo@yD097}XXDrN$@lYeW7ub_;I+`3<@h}WFltX_Q-gPg5ls)( z2(Wo+vQh@>mF5~0^pHH(h|xI?kzSxozlsnr`dLKGeXQqx^&0*vez>e9xUu4MOXA4mKIgS-41a-PwYVDJx4SrTIRW5w9kI$uwZW?%{Q%De;r9`HbdvlMjfQu`D zj@ig)uvOpv%Cjb!{Z!pX4Wje|3J=ZA7EdlVD~`FGpeX9=%d6FPd;k8ypp0QzK6|Id zS)Qv;^8>|xzrs$P;Z}Lq zAr6Bx6T=Q73h}`aopB8;Sr@{Sh3nAsLlvj&)c)aK;Al;~ASU~ZVU}^bswbERUTbJl z7NcA<`$*r}BZ3k6VZgE~$XUi%zd1hzkwzJ`YbJf6?pAsF3YsMWtcm*o1?ZLBpED{(c|Mp`dvl759>y><{a$(uy?#2!UaQUsmm@ zQhn{-O22uWXr4RRJUyVZJZK6HQzJ~9bmP8n#~p2yPE%6NoDt z196^=b&KmVfbuAG?VYGuLizJ0GHbg$!M9`Pdw}tG zLZJZbiGQ-=hx1mOYJ@(0ke_yF*vOzr);i1+NT>_3QT|`Ny>(a|UH2`R_l*!jNCE`6 z1Zf6QprTg1bwjK^lSwcL)S)q;Yq52<|Y&`+eWsnftqUW}auBd;g@n zsIEG7PVIHp-fQhf0R8>yx6rl~WjJ@dL5U#QsgLc~q};v>H0>gi#e+JhMOVi~Z+)jK z^$YR7_C2c?lB!X08IqtFasHo)Jc6}Bd&T$-yn1@uuV_N-j4X$-y&PR?|0v4hywrzk zfW0aWbQ3cV6$`NFDZ0gl8%(qz`r*osr^>w1oA(?-(Vd=6TAF5q1e}0us6)G+Nqcln z@(Q?(kFwe&tk4+##!=#wv{-2;k6d3YNT{zDpJv({e8f=x#b1avaYIuqZClc}AP1+{ z8Xsgg>}BKX@-OBs;IV57B1>Vumsj*$X~|7GBf_QiTwKhJ3_Ij{t=oZ@Vqo(p3UWa$ z+3;|)&g)I_4{wQ6Wmlz5hZ;)56=b1Ba+2aaoD*ue7n2QnIJ!rZ_!@nB#dN!AN(`T| zn5#7htZ7ZTX}uIhjudJ7R<|Xx$_(pPG3)vg*g%&hJx~gVgSdFG%OAl`SAle^nhg;0w6b#fmvvGWNG6WZUITPX8&>sU+Tj0WZ9s zL}vTtKaMfK)TI%+7C9Wr1q={|(ILC-L|Is5r-J?|K^tajd#x`q>)xAdoI`Q1bZ&7OjRzq2<>FQ?BK!~AtPFG} z8PZCH>kFH!S$HEYG9$pG*yOO4piTrkSapR}Fyq}sr#U3OXM|)AUnrtq=(d8w#x(3+ z;$uP((O=vNTNogJLpj;BzovYCM*ucQk8EG{;-WTHVoT<8k&yVVV0)o)yr|hFYR1GU z#g}sTwjrj3Rm4Y0Xc(L=L_y*DRt7rB;>MpT6iNt%nVzDn8V`DUO3ocHQX;~s!?x5q zYXzd;afsn=Vw)&yhr~v9{ljyL0BP0+-^+fcfXn&`J17Cq)ghNt(d2mZ>|3%ZG>fIcB zFkBt;sJ&$3M`3bU)47F%x?fU%{j~$k|0O&*#05hwUZ~mR!+r)nIigm8Hi|E{(-nj@ zq}1_@jg6U*-GZM~v)oXU$R=*}FA*CnA$2*}>*rlh9rF7TJNv!D4RwyXnXr=pJ$?CS z{XIvUIkhfwN4?1fxYkXyH^y>!qgQ%5`l2^(Ekrh<$CFG>yPCgaOb5AUvzWMsx8mxv z$xjM(A9w_{asb3=Lv@`fT24MoawHqGOSHQxQ4sp&5dUEJZEL{d{F%gl61i>_(B-It~T{ zC2KI1WHx#e9F=8iAhk9eJpXyt5)z_4%#A2Zp=B%HMY=)nj8jI0eu{#>wGpqB&lk;P zS=;i}@rKklXc^)~Hk}7A=4~}#oJN}a*90JjeijYnuyHs7mlCQ0M|OlHS% z5YNuH-*k{ToD=e9R0wnL3Cg7h)?bfy0>&Hjh~qv{7uwF@YKfw&n1Ia)A;fLRDt`7=Nh0&ljXkVXD;U{Z)H& z=;|4zD8B4)?^>if`j(jEr0*tXbWagffzf_>FbcZ=^1&aQ_&vnf-s zJnp>me}W%=KpGC-nl=td4er4r)&KS5l-G-6zQ0ha0Qy5z-}ti*6Epn@A7)Bp&O3^3 z?+1n2#}F9=#@}j=CMXnTQ1H}Uilk#`M0xVC!OwILP9fZh!mpHAiP%uI6Aam?Oip*| zRB8_OSGnWjb8RTeAw^!Z{Z&tu<*>>N?{;cl2d+x$pac!Yc;&+A9KR3TY4|vY9oTvA zq_eU0i`1@PCcCN$#lE{y6SYF@7D>|Oq=gjl1{+MTOEa=^3)(~YuoRmOD;31R!NHSt zb4tJ~fg{@0LT(t3h_*F{7bn4;&N4K*90w6iA0A>UQ|iG185o=QND)el5l#!D%eQ^` z;Oh0RiV@5MmU~X6+0fm-Q?@Vuf!T)-)Ms$Rqlhuc?zE_mh+{v z@9t$7qhuBtOWf3qDSR7DWA5Ae<2~|Mjxu-IW;j#KZxj*Z^b4lL$b!?Ku4*B(S;ggV zOytOx5^FhOj_tMG>p5DY!{&W_)XxeOwTlC&k#Tf1&vKD-cud9Al-_RNVi0mR@ev`4 zT{JQ8NWM zg$LJ5*UDe~M(5IZVMrs8S*Jm0^U^C9R&4UHFg3w{*hUPECquY36ImPTq&b8L@+`|~ ztKeW|b*|*}kk=vXGw~L&B}&-|Jx>f?SZ|`7eYOsx$aV3z&@y!&1(|hAG16o;Lcy^{Br_-gbibdlj!s!$3l$R70fU6HK91{aegXvYMeGH<7D)e!)pf~kuex2sRqBJ0np8(k{8X*TQAHAX-&#mEIBr}RtA92$+wLO7aGj|B330>w*7?^8bIG@%Xm) zdjG=({J;D29l5=NCdd0*Ec9iEt@8Eu4BwmOkC*WJ@bz!s6^R-a(g0WaND~ZBK-0Gz z9-HBqDmvm}MRiU89mDT=*-_p%jmf277Hv#@IYMXgnaw!}ERCO%l2skI6`pZ)kS@b` z6i0QFsg;+yh^$f>o}6G`b3rpU2?qCrIuNKYyOCJH*}oK4{g3y|I(ox?XB9z??-0c{JC>RE? zePfRnXTg;T1@<3K@%YlZMVPByIE1h#iu#N+%Hy~+@8$V}LcrT^&9FfC(rgI z`O{EJuj7Uq8C^UiV5PJLlbJprz$qfDOW!Z%^8kb}ldOoVI`_EE{=K$!FUVJ*Y=={l z37!J38i< z^54-G+O-l5h<8I|aaWWMtJbfhv$%=|HIavpZ`-6rD~|BioBuxAS8BAAW8|Rsk~1nP zrdwdUr_=sGD+dH=b0aCASw#-37gOO}m&Fge=T6a1GF%@)MkyyJuU96BfzlE5p^LwS zZ3g0e*eAyO*vuz6w#VrXxtXI0oLn~8!j-+bT?~3vf0wIuKDi(NiQTx#)KTC0qo^-7 zzGK#kx=T^YBYrjkX^k9yt_<6swa(RG*@I#DdVVvf`liPo}}-VFD6@bY%Y3r;qKW18kU+C)4GJ0gXTq%isDb| zjz=yCo2oBfbj@{9=Uz?cb0cw>%9p6(J1;y$&IQk%i|@ib{MdJIjB9uXqyKRi6i?OjCI^ zGMpT?I+NKa42oiS9~sg0EY_lrJmj?3Nxj~E{$Z+uDjDM|+WkH{RE5el76qx~5@}pJ z%hr?`>t~rKu^(LfJ)zRGJ@UQ+aj6RCJ;$i45a}PaP=O@VlST zy{F;;YiUxD@oP?oG9Z|B1fvg+*Q3{Q?;#sQri0rWCN2cb5V3*i5lRn4%|xevN|{ z%aA94iMa33VC4FpM*ZgcYG+B2S;J{4Am8~4$y1}D@@gD^qvgN!?6J97P7grf> zF5RDDMaZ7PdFTjqljAUHHL~5Coj}nbmA2;93mo2hGzJ1h4<~icteWRRWgpVvpf;!S zZ^Q2QhjdHfUoYD7z}+gpR{KB|cF^zB4MunA(Jim0O?Qc0d zoPt2@3qyUKY%5+)6a*od3e*l%RTc1#?R|zJo!B9zrX(jVK9(NYvWu_E{hhj#!o6cZ zV+4reU9V=9U;5<~>HV&Fxs+$pgSBJ{4EUFngw9Xh?>_ua&GZq_z3cyEZEcbGRF463 zOew1-BBRM_Up;eF*TUQj-+=iAa6ET5%Z-Z_(W#oo5!IlMyFM5064iYz>nAQ|G zoSt9!9Wno0^r3PxwMx&XKP6zQPas{aFi&I)H=w;q#LZ30YDi6=RX0VeYvLuRHkGo+y?`n)1zar7vQy=0>FyGl0qrVO?FO)IX@FyJY@=rW}EPuJuk} zNFDk&`JAwZz2aHK^seqVSc~~RpwzmX`zEXDnF;`$#0W$EqU)FDY?VYtI_XhkG%@c; z@gMfwo`*n;%kJsh6_eOV-^d%e+!{G}iM%DL6O~nsoO_3E=eG7-Voo==Mv~e<(QK1r zI?2gN?uLi2Lc~&@c_c}qBF2fHc1ZR+SV3bt*>E6XVJ|Y=g1O4tMyR5dt)@tV_>fUL zurk8?ryBm@p9&n#uCM7>)uk}eY9yx zl^nhzb9y{t_cb9Fhjv&%yz#-S&fDNAn8w-`v7DN_=)Ib|Lrg+BXt~8X*!Sq$NG5cv zQx9UshuGcws5E<>Uo`sEf=PYjQvn+-L-BiYA}SCxLdtByNx2L)!YWf)GI zZr<8cSeba%4CR~TVokP%q^p>rBA*`nyS7S$>rZ70#Mld@(F2>Cm~K~SR7(?oO{Mpb zZX=p(jiMB3^HB=_&^)t^fHAN|`3X4HbxCh@8+&CN-lcNGoe_j#m=M@yk{9!Mg(lZj zD5cse{)>b<0g}#ccjbqQV~mdE%2Pxr*_cEEC)Jgdv6tmJ`w%Z)%UDjsr`GoFoVP54 zc-uMq1ZBFFkoWW4#cHEJ=qU+FaAzoG31llhjGvm-k4g3;9-HgMO@meoceJMarx{uA zN)(AyUvc0GujY~0SnY|hmLzO&5RUfo#&#_~fGArXAeMgFzF`I6;IU!643z?;N7VA~ zp*MmO=2@&U?LT?=T@7StQpNF*H2At2V&5G7L3Gh?@N_kTIu$!k)Isug(iPK1@aNLo zN?x)iIoOnCQ*7~6`7>1`J$x)M*TW=|x@n_3$tKWT_YKl=eU^&OHb;7)cCzyWC&Tdm zcyvC%0G3V$9zMLLxC{RqOI%ArMThl1`6YE3RoC4}Wv6s3HC|*K;JZe3w>uKboDy}7 z>Q;wO8_TH5A(>Py-(|0fi)%<7GO!FVTII@!t6-A_(>yPRr<4qBawhMn^o6wJsH(Q< z`W^-!ucXa#_0`aAg{!-#^(E*P`)szk0l&VO`;(D76F2f%0?(m)P;V2K%BQjQA6;2= zsPVO7&7ama@gWb^J!wS`4`gV-1HrzW{%}s@V#{%SY3>hC{rjk z=;BF=f|>bf^j!}h25hzdk7DO-m~D1E8z^HqF89}WW%rJUXtdrNMC(JO89|37^-o!r zHWPSFZhzw<&39u?R?J|yn4?58Yk+do5sqdz5-t8MR5qK{9T`s#(>4)0KBX4~um0uZ zsg>j35flD4ww|&cjWHOAC=Sk3Sm``TX!Iw5MOZU8!H%M>>#Ay*pk__6T<`E|U)*ja zlOU5p2vxhwYY^8e+k(?z&wM%-&YjF*lX+YBzhVq8zYysRKcoH%3?CSrKT|^lFA1MO z2Hp3vJ5KUNjD|eIrfha8@wW6`tmPh<%16B`8259@l?gp?3w}!uTrQi=N)B3Pu9S$9 zfzgYu74LtQBueHxSFK~_jaeNqjA_S9m6L?E>k5RvM6jU19vrbR(K?#m&x$^5k`i#I zlOIk?w~Dba{xDUgssA@5j?L2|sJR70>d!T*DL{38Ph%_CP6ys9rOUX5%sO#A<+}A{ zI59+yK_r%$qxJAP3a>|WVbec3Ko2__X&IezfqxU48nK4PsgYGrsa!4`dN==x9@K}g z70|mjj5WUcdd(^vzrV}-t>UK#?{;dm5oo3EmJb{sA};6jJ~&~iZ68~sbqu)6*K=5m z8^jmpRt^CJyeatuF%VS%yj_&dAZM9bfS<(3*3HS5OTeo4zC$PoTNPW~C^zn9W&n0b z!3PUeJ2poh(cdhj8_0fXu+>R$`=-+}pJwfU_D?F4<$mmtG@GH|8?)cqdJ19wR26U( zW)CGBYp#`}sYO&?FT`--t?AY_`<5uBgz@mA>#nc;R%07MF@gx=wBvBnR#6~5^WMGs z#@5GLPVB#ip=7-;S(e9eOuXdy995CvYIDl;tp%oC-)-%=iBJpX)DO89Vae^8B1TGi zb1``g3aTzEqj}3;(cN+jpd5^BUXa5wd!X8+AF=xN)9%L)_EyZQ86p*|`HpHAi+$hT z?_^O6!~sdQmMWyG;fM)#>8 ztE~&)aG*Ws;;TptwIR2?PWcA=Q&H*cv#nGxva(6)|upQ@xARq{>Mib~jf6XL>>*P_Aiu=AP__ zF%{eZ@%y|oAt5ZRRaDuf{z0CGmAyUpr^GrVM;8yLZ3&%v3lp*OS)N(I5R6&uM z*~N$G03RDi_3%vkThO7Hh#N)1=IhQIzaF!0YTB_{(p^N#U+PD%X2#R!c zaV+9}%Chk`>WA-foJuO_oNbFYQ*ELiXBw^dB-}lJEL&Xnp;TsKrd$n$jq^8hjG4_o zIP{vAPUS~&?>Ir8i7y3R(z%WTUPY_yMs7c({6bAn=B*_-dU%pahmG_awn?!@0vBI4 z1-a*|(<7csVI|Yr$YQ5rn5s~`m!@joTm}-Ov)1luAm$z{w=)Yr#i*BwZ?!6bYh6r8CIz;#Nw|WrCyD zgqW2R!Ix4dO|=EUb$`-k1mcVUk=Am1hs?K88Wm2Bel6*cJ}`#6uWc{W+YNm0A>vDN z{b<9dK)5Y*Fdk&6Y_FOLae4|?NR7#PLMq=md&5!uB(8TuoqEK)Do&aGdi2LCi zs6vaR3gdeV4#?cDsz#v^vM$GUPG&oqa~hsK_{MqOPWtG^>YLG2YQGv&zRW{zSkn?n z;Li>m@}p5l4hx1c2=_c*+rnlZ6QCK|!Sx;+s7dwlWeewuCWz>^B$NRcK3?VAFi_PA zO#6NFo;ss=5SN8DqhoFVIo(f-y=}L_w@|A+a4qwwFrEAdr!?*CKJZQzjF9L)XL_Y! z^2F+Ga3|V|nmnEv)%LpzdSZFS4z$vdv;n-S)OQRB0gt065IBrevVXTO=SQbNu@Kch z0rpt{C-G4wZ>=vYFq=XP0^xCU;eOyVjyHu0q?Kc9pbR)~YKpjVUO4pt)w= zMnXzgG31edRQ~d?D}x+F@z`JPQC$gqW6ij9k58vQ`XVgEINY|j9QUhhUNCJkrmOj< z@p^%r(Se`4@;9gGtqJ!CvrFIi_F~M({o7N8oGxM1QY{wD6{#9|Uf)%&f6b2Mqu=3! zYa=E7LifhliC;`%$|h<=-Hf1D@M%}DX&QpMTq5(U`tDfEerov`Dl9V{;4XMRWZjr$ zOg@;tNy?0CAY;l^#7u8^$_#w^EBw^|KyFBf9tz<}lvFhufyjY-Cs-fCZf)wCrPVw~ zCGf^V@G&Si1hz^ycHm_EBBcPnTx9>xhOYIg3-I^`}&n5Gp7dxP0y)STI+OYPy% z+U6x|Z=!}1aQ6fDdlXv#YRTH@kB;oNY^wefx`&zZso4q>dK@#Q*C)Hq)c-9wc*-XR zgE1*d`d!Au-Z2#>zhun}PYX3mu294mFEQ0iforo9_n;&>R{v>3Qc)t5$|MbenoKpK z;WJ0SG$Z0fFa?=+Lmz&xqNMBTUyffHFAq$GMwBX8sP5yFF2&GI(cQS<{WqC1LJtf4 z3-1I03iXNw3}VMbyhjSh(%EnoQuD)+Y%_9catcv?l9!HLIsHYCupX}WBP@PtcNX@@ zaje`Fr0Nrc#RMNf=@Uc^QpJRtn{p;mudcSS!FMdN^&VJ|M^R2p3vWK)H^+!DPNCF( z6C!SY_zb>92wul}7AT~_p^!T_?%|7<#)PVe;fB>-K&K1#I?1VUmV@h+9mO~{@r?67 ziqksxFh??NJkUnX`HlTXg+c&u;$Iu%RbE~ra@P*)t#bWxVuiwSM|o#A_M*1_j6(k)BSKT14CL0`CTW_KEg`BBSY}EXUN_G=lS`*YjGkY z{?N$PmCHl&*0V(a7(c@bmCy_+MSthlj95g~cP6si6gq{;Tq={%D#i!*fT1k-TD7~P z6j)tzX~q1__iY(oJMxNK)pkX_BMhuS= zJ5qf*=G#M2dVAF5we7s%u{Q;qV#i>wzJmIcm#XH!a^CZ}%`muIBiA*YOQ?y{SZk~X zsUFXws(k_1GjjfOufgfFu5rV=k?{~yA1=Gz!eTVTnPlMx@!N$13yU<&W-CI6l(f}1AX04rPPunJ>C3506oDT{?O=SCy9*k{b(hAQlTLZX`(OH3+`@ND3!_O-6bF&ivot#O72fUo=1 zmRkMS_2DboraVL!CB4^v!pu-Cc%`TeEU{tb=cRhJF5JGH)z_m-id<*KuQ&p~cr z^N4c24Y=8$r5jb4g6n*DdYf|4cz=mEgX41_Hd173H6!eGPdGD_*ivmVGSM;tv2vO| zUA5fof4Xzz(R_a4h3VpTJNBy{-*D0)-;dk-WXuk@t;_RL&)?d^f4EBpQWg%kg&U{b z`foLX30FH`!kTKaehYRy>q=7oyi|k?-dG>f`xzsFPC`S)uHuY{`6|F~aEC&1oqwE3 zVezr!)~q+PLTEd=I6bjefOBl{eBHi7}y=sKjpQP zDok0Oh?`#DAON)-F2PneUmJMC><&H-q#t-~RJ}T`4V+C*b@B*Qmm4_h;_s%~wZ}5f1oM=Mmh7GkY4&MvZw0-`-L+uHMzsnQba2 zVRzWZ(ATf&Uc%R{EFP$+LW<{<4Tjg+Gqv9<`GL+9IiuR{NYSLphLstXn#uIrNWUbL$Mp0^tTS<=c+NGapD#~$ z=+kzrzb1Hj#J#O7DOZuP(vwQz7vOjK*zd|dS_CyvDjH6yh_`W_{R*$7cqTw*3n2s9 z_0|}8a8Hd3%$*0`mr*Yi$th@_$*{Nz97FN_I-Junp43+8s@DfYD$0umQquWrxO>u> zns?XGx63PD#~)`?P4>nuKC$cCf5rS;lFz`ys}%nssrHUq--HL;cdfa+tGL?N?Oy?+ zNl&4%ZC}ggq#`9^eAEkxerPrG4J+Md*^v>-C&EozzC2JxA!0 z&#TY_4J8uCt8r@W6|{|--JIo;c!d{=GICEHG%PJYW{_wfTmup`8%NuD>W(8|id^!7#8#12$bSU8aFQrGaNi|Hyd z;+brQm$NRqZ8s3eqGC!k*BCEJA0hes>1Uhn-Ihpt+Tof|NW*N+-Zz_ZN3~ z$3qi7qszDtc5$bxfVm|&ScWvRWe?88bv`dBm^xj#YjKz~VW*p?siNbmcPZ9lJLBHe zfS~zVnH;xiG3BQA8E`!2OK~qP@3a%pLz2!-WmSsD&r;Ru>hQTYu3QZ>DVFpqg3>;A zrDyA{{YLh_jZ4_XiR9@Aqcj1x$Mjd_`$!vw6u!HnLnIS|aFuUapb4-BZJMqzE1wWN z+O58+3&oYKzFi5`^#eR@k6T>t&}=srT8>ubog#r*^@SzM>dv+wo`iT`v0#`U6)bt> zwED@T7mPnI>-$FL*8NKbQV!E{LxRKWuKM21dgfkENN8n?r+#I|=X@JQR`nEE!X7?{ z6KxFl7pSs(BM@Mtlp%P3Gr$*X17;l@+FqYn8%XGxm3?oM(m%%s=sMB;zNYz{H{OvO zy00xdUNUa*mS3+4-_Mi5wwg+Bt#@AEyWQV?30(Qx7I8?|XKlC8>vP_ec()br@@jj` zd~yWmCsQ3K-OJs(K)Wg6Q}UV?bI{l9mdTkVJGBCR{QUxLnj}?TEd+RN< zv=S)&2Fx0;!&^Ud#;2J68t(Jv{-z!9Z5v}Z)Lhy1*um~* zQ_s!=!M}LCK|hncY7LF;n^$(Ou9M+_wme?^R=qCwT2-Nw?Q%A5^`&8Z`U8RV>uJg1 zw=Z?e+H3_DL8*-#?^s8e)McTLu!<>RY^3daU6HdbHE`Uc@Ad12oHA@y`TnJKp-&+D ziJ9;%C+4KR*+*55fOQ-2qp5|jp+qpPsXlpDi0_m&TMARU{$OtE&L`$DGjz5Y0w62` z@`u9I{$8l5w>TxT@Ck&b0DE;d5uGu}>! zOa8wpB0TMX6Po?7bYDEQWRNe3Mk!aUZ3R%o9!2#xKzEu_NEqwfyk5O}7~R}zU^ilA zZti)tb+4kMQy}2nFlX0zcu-u-l&Brh!)WLJcXNWnf4G2IxL^g?-ky&L{o1pn+V&tv z&h{0>hC|(Qs%Utk>+Plm4>Yy9z6m7v{tTx!qhqVxIPVIePHQ!HUX2?ssXu0&>1xoq_T=t> zmXVNs_D9O^Ievba=-gER&pRM++%G|6AoO2lsPpGXe#XZ=shAAM))rK3TY}z=+3ejo zVnesYy>->=!cUCD0I`mIP4xV2%k~RdKB5IABt{%tU}Z7lM?1#`50Ek2_)&OOVGldu z*W=Vb!)yLGUvIktE-S7@;UVL~8n`pu+|gX|ws!Ox0$B;6cyo%=YRyggAM?MGzRu@| zcI)0Jsq%e?=&8z^sD{6Nz9|Q{kQ;@4PGq3czv|22e}Yt=b84Y<;A@-ivv`)a=?LRE zf11^Eg~27Dfjd>xGEztu!CdM*0;%@c$izZwRCqPbxfE4Rb>XC)Mg(B44Mn8cP+}-l zqg0gj^<$wm2)Ye96%^14O=Y37m38zAwcA|gUnQT?U*e+Ec(uIE-$VM!G5JWB{(|56 z&ZtjWx2nw?beckv_4X8YQ^N30B{#-$gS3NJJFNW@?RAw)s!Fv~KAHg*;SnJQ!>;wH z@Z|UqzlHvYS{l?O=hx?nX6JJrSvw%QB?E*dE%CiD<222z@tv?-i*F1y8JP*sD;e;!dd*jLOldsbX3VlSNPA)pbClI%Z<+0%(RErI z@$07e5I2T=5G7_WcGo9n_FHEXbOQt8PUSE}Fd>f>T= z#HK0=bfzKY9X_Ny*n24{F}?bsGbd@1pM;KuzVbBCv!}19iY@TWO8}1*&sN7QZI`cd zfcPcY8j{P5{W_BTz#y8pv{;7FR)3*(Xj9nfPt(`uv6==WpYv4Bg@hOj&}@4v+^1jP zHOgyl7ui|%z)#L=IDG_=cw9yLV@jI~Yp=k-KL6cm&ehYu{w24K59uxLfS|l?2Bm39 zFwdMT&yNy9+T?U1T)&O1lN4%0ohG;JYdlh`c(u}|EIGw*goFq&bGAmBypZ&7$^ZDT zNLqo|eTd_b2B}h=uV5!0**7@@u*Dq11KJ*wu_ULSH9p)h$;+P;b7Sk2Q?GEuwEm0S zR?1u^tEI_BPM+r9a@((OVyiwV9#yB25Ng(pEv&zIfgkZ><(8(CN~&xwr%|xJFGQ4* zTYw};-&2^y?HR9~o#LPE9`TqDyiT54n5-(|n5_|VXE76s-7B{?#UeYMx$@_DAv6)N zeg-rY>U&Y}rWVfcAFoY}41*Gb1hz<%O-XBXVA~#omSg z7z1oJecCqhdZeUtUq5pY3BZn4En-wH%m&C@Q?6#PH|@hEEVi67Jl?%cJHdoq7(*Jg z6@eF@$}qqeK0`w*ES%8eiPq!QfqvTLA*bZ98kHGBZcQng(_t?nUua0-z=<)?{bi5A zJ={lm4ULsm&i-Sf{9&RWy8Bnj5HdXj>M~R^+GB3yeLB>CwbyfJd(w|I^(jJ*qq}#-=oDy~di5ZG@otm8 z>cqf6E*_#fu#H@63&(UcH>@4z^POQcGm+%4|ERd`ivP@No^%%=&{np_?Tm1Br8xBM z*G~vIs){U?83~CkDKSBt%{)FL>`&^mSicE>T`a^cPsF~x>5s;YWEEMh+nR#*ls+0# zp74wZD5_saKw;C_)sAqQkI1j7;MEY;@ixzd^9#x>aS3CmT;=@C{!z6sI3w0K)~X*k zXW=+dH#%0j_=4woX>s%~LQf&cjTbD3$zs$u9WV=7`Mx|2ciN^QX|N|1hGYib5XL5Ot*1~<|PUJ#|eLLNl& zYm7~Q^LhRUpOIJy)_56rgi0ofAA`A!mLA>S)pFyVzPb#qaP{{pZ)<<;)bICmvi5qC z-~3BJ zt)OWC;Zlc7pGm6-#bESK*cuv2N5aU@kE!tZIJ*f$dciN%90)Yr@|j2Z1@a+p?2kC4 zifK{rW%C*FQvUc?@pdrK?mGn;PUo)v^ciHB(ZJUptAAq!m^#SHuE}ca$dIz4R$eR6 zBlu0`EdyBz+gum^Bz>aOw^5yeKC{vezjZjxacgTeVzDn`uKZvbht$?j%{M#|jN+|H zVNc{ECTVAX``pk$7(u}Op7m8>v_eTmNt-QIuXK={q*DSe1c4#*vifLxY9vcCD})bf zu)3P=i?(nO8b85r$C>J59oDh_As-_odQeMhlsl)la=IJ_yaE?N|DY)wo4T9u zerEBZ&gD`e4v)1jzb+LUB6l;I2DJM&_)ePjW`1sEdO%CY1)Opma}6l|N7CYhFCDYuebXR=dGfT5-Eo&)pd<4D! zGikB(Fa?a6cbE7?)+Mg@w#oaB?V1pylGM?r$lzX!H=72_(45U!f4F&24lmPT%-q|CPCKkLW$0wCEx!eXh zy-NxZYS%9gbQ)Nppnio&Qa(19*f_196U6o!1cFT_6*W~OaC%E(vUE~10{a^BUFF`u zR-BT-v-<110tE|J@|#PngZ%2pqIHhH0rnkxP>7kX_jR`Z|ZT8;bV zs^`sB4ZQO09bCh7R~g>Wsv2}yayc1)J_?QM3qt8A+lG4R=SBAc&l1D7ZaVq1vJ+%$ zIF zS8>wwf2W}TQ&9B3MuUSgwysjNnfuHDE@2mIz12OiDc^d4$-m4jWVXMv^`?-yKn8YI z1lWWIeU74f@e`2Y?ceVQq4_0PqiMMDs_f1h)N6cJ-u7$ip%Y` zX;anmUHz~MJ1HT#fM-#*OD>r-9FI5ZDQ#@F=kJ1L+$l)Yk@a+iozJytW(6u8QeEUT z`~JmJ=6ba^U1>oxqn-a;5k4iE-NDkU8Wu^s)F_SsattN6p065q_p#cEl#8$bhq`CPz61A9#x?vCSGd1HcbDg z#_uYJjE;6K1y|R`T%C5VI>ROJGkp&*#giJ3fPQ0XqQ{3u2vQkV2*%9R?9EJ+X}6gHj>x!!heAvc5#M-1a!_m#`P5v>L7J3dDlqn}k? zK308=)7l<^?5n(+uVO<uTi>brOBJ(F2FE=5S)peZE(;fNL)IO!DaPj%buflDN zc)xChkk_s&hM{InTW}A}XFit!HqOntCU_27pAyFZ}s(y*EmFdX4SD8`1HBM!fdFDme{vk1mD6_bl@VJ~1$5-UdcA1c)iGt=7OW zF~*m1*=Y>t#0}a09R6jKvn^bXW-}YTDLgI2thQov{4}Q!oRCzT^ zGMuC=MU#kkF=?%*f`?^hLsUre-IT7@M7?f$JoWY>gG7lk<%$+11!P90{W5gp8R^hv zrv5HwXFsZwmu3~w)8R>}xwn@I!O`%^f4nqM%z-B`KW|mU+_KTkM=2;czEIX;VtRB_ zrJCDV08kJ|Z2gjayzjAx7+&YBDu2FF51$N0FRK&EZI?nfgRlf09&0cod-4|_@M_GF z9jOG4td*MSe8a8PdAe>Gdmi2G6x@-m#;WJrv`Zc{ZT%g_@buXUPt%yt7whq_Ip3lTnH3V` zLhLExp{CGdoZrdX$$G`1WZj}e9~Z94Pv`<;(`pLxOG@b8PQ&KiINoxN;#po#yO5&G zA7y1;pt^dHG2K1R1N*|o&`n1)v5NJ&q#sl&?9@^hg|%&}8s&C=82d9mo)?YFX-meT z(%)i6%-un{*pgj(x99+^2oysDF!OZ6r@lQ{Qz68a@3EYJMZw^Qii3K&LMD$hkZ~oe zkGyJKf4dIgdAid#`|CMP!C&I*H{Kb;+OgVF%JvFGb+W9szwlWT6F|g{^}B7uxE7&i zXoyiNy5M!T*1Z@swm>!>YrIn!e4{PXTu!A>#j;;!oEVcGU5akgVr}b-Fi(kE)@I)k zMZ+NlF&>405ff;AcLW)PDsL;Y9sa~n3M1H{hJk$ID>{wXl1MmVg-6CFC2tf<^d>jR z-nkJMV6f%;2RgE{2@_I7JRHb+)C`mpd>?wj8FB#frRzVxUmLhCv6QZB5P{!GDOQob z=}9Bz5&`Daa9n_jBTdbY#zR)*nBH%BKD1mIBJQKdl))p8jaq zDVo_?gi@DRfk*ww8krX_tDA(23^=y!PaQDy+aOO^_e5Whdo`*9}J>IKK9Y zr`JgQ5S%0d?oFMdsaz&Xw1es0{7-)s&uW!j%YHSfiZlM??W3{g%q3E0C+ zpd@=h@n0e-$4CGBnli3BlA{Q8_f&PcXM1AIME*}tK^C^OY)J12rUdApx*s`kf|Qup z%8259;_$G_TG`B=_e!{rosErl&o@4>L{$aXKyth!j?8N9qQyCq%jJXn5YT<Yjc^ z-$iFOw)`s9epE=Kt9nn^DMT|v7RxRV%uN?#g>baK>ba7exO34n+S(Q8UEevN^z;J; zThWRd$Fq@lP3ktpdQw2_E-x2TYXG&k~i$NaS=>od3J z`GU`3q`Xwc?nU0YQMsz?O$%7Oq((OD9KH%Cb$rR!e_P5&u*IoOaK}ycQ?YUJ2v{)n zkXU+k;l^~Y(c1KP$`|?u&hNh%{;zg_XC2RN=ojYIKG#=Wx=IVuip^hjr4D~xAV1zd zN+z;mM|-`ujS=Fv45`*AQkVsD|yavc}|sg-`UOB!qOvZ`KDiaWMj*afeqS; zjpBVL9Ow8WT~GZtGE$Er?3+3En%B*6F^G+NA-%@Nlnp>R18ZO`I@K_rAI1NIZ*qEe zpFM$dw1g2U2k;jAv84SatIK}>cedE4jJN@KOcMj;eih5h%hU>~iqK}xF4{0y>N-AC zj52)9#nw=!u3qQ-GB?~!UEXRUR;)PCOTS;t8E`waDk*j=V3^4S+JQi4lEZB7WX(-- z)ekJaua%OLLiR13#-F9!zj+r?a4OF`w8C^yM_;i)id7a9uX86h0XuNI%^`m#Q8s$P@Z`U_( zXv+}58z|EzcK_s3zW&|<`{lAJkiA6zs#%m}k`*d_5Urj(>}lHM7Z@lXO3 zUMy6TS(f9sISY=r8R~$PhL?dNqfyv3nz?{6ZHAi{5BC8TQP1|3J!c255&f!j$1Eg+MQB@330UYD3l6!1G<0>lpy3qA! zlC{U|vmJ^N<+bBljjh_N9|+1rQ!)LmKbeQcq8C%O2QA>g3^ZvsWzjV|>T1TrPROzJQuMhG zxyFHGwev`)sc48)Cz{^go7j()LK6{?8ahPUJLoO{^5tFcTEF#v&6>%~ zI&K%6)3JJ#PnWpXt=gTyI6>uPZ@2BY@hK$hEc zJbXa6u@kGU>0slxDQdpeU*&@Wn&uvU6f`#9*~{3Ss@X@N^ru8wBNaK>zGl7BBZsX! zEQm=E{D747q`VsC)+H&HD~bx19nc5qX)D!!aXLx_V&DyupR@e&&+s zk@t3r+KlS_XxS(r3K`zNCIIK72tQg6+9+<&Ja>kfGCFitPXMCAdPFZy)Q5#p4;n%5 zk^aIrzgaPfYlrAe5S|xx8+NE8ralr5x8i2#fD2tXB>&qbum4wf!|nfIcf&UEihYFj z`jF{Z(ub@0I>AMGmsv`y25pS*RpIlioIfUTbjvLj%xw1t>kLKugwV)_kckm8PzTO# z{9~>GELwS~zzOEynlIv!T^8^I@w6_HEw5YW2Gf8gjGi5QXddVI6?�?yIArF=R}@ zS75<3)0bZymTgu#Zb3?0#a?_|(!mODpqese| zj;&=t$T&8SR971T z-}F{Kd1PIpz~>PY>fxCXGJY5eN$02KSy_eMc&Qc>(kX-hLqi`pS;BlL)6tFNkv! z`5H^>8cR(l>$5Uvz=B`~GnV;sEmf6FMDumv9jl#iRAAptPbyqv7rw|qzXVr4IjC&o zR#IJ@-AkK5!>>utG;&bdi^!11K(+XxQ@=>JTkA$gttN4TKw?mYVj|7&4ZZ8mmKgGO zqi*q0G;g2HMZou8Es1vf@;)o0#giBnFhs`SU5PRxFSR|70ZaS-ZVG=kS9)>r$p^y; zp(+=rA;sF&b+(y;T1X;3FPNIGx6aIOvFkx~(iZA6UPHkauTxuTMJ+i|-@%-So4f=m zZ7TPBGwm4vaj0Sa=*RB^--J?`^cj)4d_5p(;h9N5&(l(_@ASZG^=p~?U$=|=n+r&` z&0$R4K*f1mj>Rm#UCvs1D-1{t3`{T)woAcvxQr~){4tYJtvU?5h&rD}ttL#g&JG6t zEFHeV;=Wb=Whzi%m9;o*J?+6+MWKhUF7aE;N$+pq0Z#_9f3#|}Qj%dESY)zcr(bzo z3*ap8|M*U?T!Ep=#kczA@t8CQAZ6O`JIOrt%x zpmULz)mc>T#(+V2dNuoPU5kl zXYxv>+q94VvW3oX%U$bI2v8X|?-D3-F5vAE=WTl3by{J$X$n;DTC)Gkj;Tt-$rC=z zmKAjlFz&7}QPZ62DRDyu(g&ze6xXZ7SkvMo;0q&v!yx-K#oD#OT3-Wt4OWO`iC?{T zFp)2B2*W)18F|!Tg*S0u`cbDEMA$8yu>D_}a$NBvA-nJ`dB_elD3+(x*>{fty4m?j z;iiS-)Cg?6wk#9vjd`eNVTz=GJ}c?{SeUIsNTg3_{B#ni_w^mITS6YR?gIb~9O8b2 zglmtLy%X1DAVa3DGLYMx9mx%ZgIK}qm^oMrB!z{;)Jn#&#-haPRT3OIUmuBD!^|~bA<+A!CuXj{ysqBOh@#bRtvmqX( z_qqYUIl|#UXrL@Kj)}UG5gC5+JO8O#mS`_wsxj8hvvOlcopGlqbrj7NVsibmHSnT0 zCMVkFxVgG+QE~|=UWp=C9(Aj`Es}pPj!~u;d30zXg+QWjK$D{tgYq?C*IRq|gi|KQ zxaAP#R=%Vo)A%1DZDiMfdOcs|yUpHC49psE(8i=;O_I6blNwPGN<3|-K)J~qkYUfOdH$+TuGY#Hb;w5X2e|8e!hxZocN#@aSv*F0HR z$ao2ezUgTe5FZcb-uXi)&{+^Msa1vi0z}Bj;}_uG(4jifY>IksLZk$&qfDTVcP~@M5SCo9@Li98Xp~ zlj@Y?uh$+QuS|{)nK#hZ4L=Tjy;P(_N&9sk7L<{+i6)yBr$l}l@B~GJ&IFW#i8y}8cXzXcv;6(KRv~)FsZKd*Jgek zmYA~UH~Aba)u1Y7FIa_BYcO`>@3O2oq*`Jt?^e|@OL3PHb5G^4J&2!HWeMdeb!h3T zuLqUKWIWV)h^l|yAGfSKMVj=AyXnHzgyqZRdq-DqA!YmCG_jLI#PTM1#ZL6wYUoL$ zeLQ$x6auUVe>6}T6%-USG6E4uS58#U*d-4!95HPFaaR2<3HOExX|3l{nazXIIxwxqbYo$nGFCjneYN7;U{Hw`0NG;r&X26lLl+1-UI` zbOM)`Cj6>$KvgWHWo#L5h=`U4_7uH!0!*%e9%c#ju8#Vh?7b6k{n{oU0yrMOsLSoH zyT`-xu0f}ja5Xr=AQo#;)$E5RX6qkip7>tNh@e3?HMLtA;bDJ?(0X;s|Cm|d_{+?C zh7GjDjplwgX@v(qjE3AFC-<48-IB}2QFkrY42&vf(hcM6vqmzv;FZMMPyKXUI~kwL zLUSv+(CGLwn$hu4`+oPWW!3xKceF~J(A_YEdqHbP*mk;&+JKIQGux}jnjQg;bN(B1 zp_N6M9#zYV<%!b8R#q&v-<|mrdTOTAYlbJj+{(y&bQrrzbtmoy(pCXO0sfFMCKWNZ zD#)lB3F6bdeEc}~72iP0g2H~vj}$8U)&00Z{RQ~i8of)h$2XH!&bp8%i)8kZ3F^+T zfIUh*#0+ronHo;ab=&`Iw`0+Z62-*=bUx`qN^RP+a$ zi&I3}J-eT%eLDd2@eWZ6#$1U1UVlLRmK%;n2chH!)IeNQF81%&X4J2b@G$r6AMBfb zWl}uOZyO9@Z5RR#7vG{EK@6iB8jQ7?eQ#Ks zZMH$!+exzE`lBYTE`p*`Jz69pK zGUTORJs8Jjt^`vrbujXUHlz%M#r)xnsa{PM2c4_Us=vCbW*lLFlQtl1Q+iRHkZb=f zZTD#w17Ozjg5@D0A(Na2VuwNGR9stCi;QcrW{RD#M+h(Im)Oa1UD7@4KJT_pe9UWs zg3Ar07Xt7RNlktSO~>8W`(!+&pk7jE>(H}(;&s{MFFN66Z*c7> z_z+iZl&G)V?+`2yVoZ*Deb?>HuP~M7m=+TBz4I+!8Xn;6>@$dqSvLilaonSJ1FkJj zAydCq9=06$$TdzR8JUh0g^j>rrVI#B)E>;U0`O$V!N&6T#JqL{42^W`2Ny=1Ydh9_ z@@?M=K=BzO+Zy2z9n{_b5sBiJN7aFM7#kf~NM2sXzPjC%*~ua?d>rz0ZR+%UiPwE6 z7xK!+c`}Z%KAKT6CxbCUM$TP*9R5eMBijwGb|2H|x?p&U*64%y6IbT(`&9aic@(*( z;t9N~(oF3CT^oN8O^z(Sw8Bq4GID<iZ_|xs&&YO5%8qO%GqGvyo}Xy6iYJ#l8>Q0x3M@#D89O)M}kta@YHS zjw`N*SezUAzp6j4-P9ey?-e5;vxE@8Ruk>@skfX+OGvo-{xzkpa5ATp+wW=vAhy@m zkGvyv6U}FbpYB$Q5m?>|Lm*?$PEWn=d->$5F)=!cnl8^QR);iSUCIK%N4&l%cSP4$ zi_lSn<67u+?VgtCABa;SHs+zMTQ?=xz&0u4#%~;Qs|Q3&hdI4 z>pA5xQn=No9j_GFpi0E18(KxyNJ-TOY1>Y;boi3AACq}zsJ(rS&75zUyGj{N`GY;n zTAe&wCgP311N+EC*mh559BO)Ii(7ViRdy}RhIYYxZjWNAid!LY=E{7h4Y=8k7GL>l zrYiHjn}EL@*JMZDJni)PbU5S(T8{taLhIfG%oUPQm%yLX-NWNlVD7Hz^bNoeR>;b( z8i&eh2N7W`k^Q<_;kvkUiMUx~ZRg+&HI@(4ezGoe+U(h$Wgi#Jej{~+?>b%3t5zHZ zl9ny7LYX0^*_tbmdarGC{&Q#8v*LTO))v0c8pbWV-Zn5R#Ptx4u7Wxb2{u=mJN#k~ zrKd(5P{r?EO+WEmF~U`kl0imvf_X>!X`dX202n$JES+-c;@8&DRjd z)Ox>;?o*H67J61c?z{;A-3!k30Awp|Ivpa?UQ9~!W|f3y`mT1x?oB8q~Vo{!qRUv66r_X#;}HLh=# zF}C`8x%P?booo(^TM;H9WPJjVtOacHppnf*j-!E`IM+nw(xg8E~E$Viy zaVpt*PBZTn`!&hZBR12QtT_@gyd-)m6U)C{5nPQ_e5gW0#)F*bbP%j%>}U}B9r{?b z{=$VT+$!>q&pUI)@tBJHvd5c2v=)cmK>oJGM#Ofuv{r`2qK>+)Avp&h#NnzVCvz@) zM)RQl9=zmFG8as&cl=EHzs#iFVq#27<84-?uBmxO?~w*+QYvRosE(VpT6bK-lP*1z z#CL7{GWNr=-X?BS+J-UI^ls`!t4R`2sFtCQMKVeNVx(=6PQA6uo0dpa$z1|h)5Wgx zmvVPoeed4*!@5io0CbvrZR*3@g{b#u%9GoD)HHkSI?Z@P5~1WF!wSsHBEH0E+_paVa?A|Qd%g&K(7)C z%78J0VZI3~G5x-S?n`*CDg)OcKT(F1h|s04S6J7!;!0^4JEVe1)S8xpnKoqHXcVyQditjF-nH6;b5tJUT>_0?+GcZwHZ z0NX?yH(!W<%rx+nUovU}nB}dY6yD@y+(-B5m0UgzB%Fb4RCY1v+B&jMaeJr5Wi>d` zbB^sJ1W?8wkq!85BSL^Pfq2-G%}sDpto{wr=PQ$|B<}eP$0M-P(V@5 zySqUB#hXY-h9okE7OvE-ZK928R_z}YVTTj zN)Hus{xMQ9JHEeD_|dsJ=S#k-=J*YBoU37B-%SKnD#(WZOCWFxa1PDGo0JOMq%@TB z3+!)gU%CLJb-@s%Ib`{o?}EUqBz72FKuh7LmVN8Z|4j*@-`sFY`8E7tm@;oON)-6B zFCtk3GO01Ada3B-Jmn|bVP%V(!_nS6pvL~69YtS6K56x+RrRb(6+(Eo%^#CF6im|D z1!1+gg41lb6@q`>k$A?U8s`uUbr}BWyYG`{c7sO)%Z3U4c``X0Lb73>F%U#t{C9|!St#mUw|Cf1WSGvNnnCmP%oZS2pQuBlJW zQ%KWN?zKlG4His5RR;mD>xT$8&B#lqoau);!OM(No*0D6Sxj$*Fbnah?9ovE6q;@T z5|14QGAd?A)u5Ue3G@_=OdQd+wmm)Xy0j$EpAn;moUN{nUVJ;P|NR?hy?TC&RxUm( zN>YoympFY>S=AfGWSEKCdUtau6z+sX&{uv*Fl}Yu-7{?}BRZQ9t?@5}Oio~m zr|K>%>e@&tDQcW;c~$;$0CRW@)vtl%$ybIRGL}DH)?TsC2#?oSG3*MGzr&9$Hzend zw$%X@b70I+oJ`>q0{ks0&z%HN#Z{Bs7F_c#(U&K2vI#uKXL251fYupL>lt6c2H?0Ol_=m3~DA~V@>a5;3GhM}CX7i?_vPHA8gh4^-kOixA+hhfYL#q3i-R@^CF z%Bg(Xek_L*iMla(nxtLS_F)$LG5?*}M5_So`|goHg9m5goV|AgC6XO}>KQNlUUG*E z5`)a?^Ohp=nlugbBd#7F%{{LJHTxa5eOPYeU(IHqjM^e7S=S`hwdzDDSkh_MCtDpq zjxttp3;YxAYLb#J;bFI}FtM9Hu^m9ep}aNVee7hFnj`jiunoGkCAaOtbkMhOrxcCf z{~tKg)s`C8CuQao>QC_{7c5G@%{s#jBe58xT@+jt;(%0TIzKItt}rUM#QGuK_`8wj;Ih`62=teW#w>t<1RVL%2YyK|W+FawEFUa;Hg*}*kt-7DBE_^X zpO|YW_G{(3_2y~Mxpl<<&%93J8StW=o#`H)o&a}p=^QhVT%c!?{4t%~GzR=~K}A7B K9{uEL;Qs+NrVYvf literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/04-done.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/04-done.png new file mode 100644 index 0000000000000000000000000000000000000000..b8df728ad4cc62d210e68d1f26068ce740cb908e GIT binary patch literal 58328 zcmeFYS6owF_brT~VndXwC`FWBA{}W_MCrXrjfLKVfYgwv2uOeEok%YcklqQ>dju)c zdoKY3B!QF@p7(pdt8;U%&bj#S3s%^_ot?GEnscr(=A1iJS6hYlI_q^RDk@qvRb_oD zDryNTs*BE7FH+9rHhj26MRl7>P5HT@Px{X6HOT$-0A4}}^_wS`eqFeF@wW0O#!E`_ zZ@w)()XNo0t8whrhCJ3zuPOhtwvje9=Mv{No!dA#Od0PN%t|>ldQG{ER5=y6?Bs?n zcO+Uotr7{Ne;Jm|8GG>|JJqENoL6s#1pcBDhrlni8gRbM2+kl&pLSe&vMx?NKu5N- z{XS~%d6hCPDk?^rixTBBURYduj1$9C$5YC_byTQ zirj+XI|!QDK7y5#}oK7Z|f^OePr}>n#)>Is`^_zm1xk` z8Ib>gCj2l$dc+fLfZFpe)cd|J2WZ(!dwGr@mG?kNw2I5nK_4s!@(Z{#64o9|3(ss-R)YnBmk~P4pbuGgbgCHpBZ_dh1drug~ z4_f$a4*ueMaBoiB)dnAyJ(|#UUA<)HhYk?dbBMX&DI2I*;V=6r8}9G_%yhUt|Xd3{6yFXBJ0w+ z=-71DtQ3wTRWuJ5a(CzKNF-h`oh|&qQ{N2`^6;$*eyL;JC&3wVl28fsA5UQGI*9=v zFPZRaLzndg`MtgONGqVG!;_*NzCbYY5DS7-XqU+! zrUw;YNB*o|(IM>6$I*k|cv29qz4zR7YYKSSvkb>4@Mc2iiFA@i_l!Ch+_Z0UW- zk1T-Q{MevdjhHls+W+vX4NrvE)>}wb0QDQ?rmyuzWE?&D_9I|rd!D$KGj?NHKYwbd zpoLUcogWP(Dv@`l%1B;VR&idJXb8S>9@197|Ju&UcmG=cSzgka-DOYV)IQd5H@t2# z1NREnirIVob>XLI5bLM3TeyGv9GSq*|3b*1*HTSfY%C1@#Q?stlp z#hb3+s9T!d?_>Mk&DSII_z!K-)~BgCcdmyiLHPVWg8FE+-7L90_V&}jFO{`?gKRup zrY-$p^-C*AczS98IB9zb4*W1-nSsIZvC;}DI!KspZ%^-QY}C}-EdFTLyQAjhHnHNY zuf1VOTM3l4#CLsf@iHhxe5mpMLC{ww+B*p)h}=sZaYihaUCIR^fyB*_OBQ0&xf*ft ztd@_`vnI=-(H!;8GErlxeFh>XHA=yJ5BfFBiqo71RkhuSnW}w%k9XERCY^S=L4+j` zHZAjX%LJAaH2zT@BNxq17!0g-YB^o_HBZ=&+CvdJ&E+vL@+KXTlvODI{a_AAbQVbw zwX-7hO|<-B$TDv@N$a{>b>VBnO(d*M^Tb7HXwW_EI_>kG%ayeCz2_b{^SB~AmiYy- zyIbi2v_pqhbD69gHPq;B9G~6HQP|!c9McYmqFLqCM(*LxrPx+C1Ot=L}=K?Z2yU*~FdfDAqS>-!(^&V$yVlUlok09vj z_nM}&L=G2Gf#EgKnW~2CUfZ$e{wuYaohq=GtV9U3e%92S`EGJTsaZ|k&${u#rfi|w zaUzTDs*ftOeKr?!xMlBZC1ySE^^RB{Pi0q^B~Fb%-{9h^B{Q9yq#GO9a2T zOM;0DkD7c43GpP)2P`)J@Zjd|;V@WM&C2U&y&0PGvayx0RhH*bkYW^X6CXyK?vIL~ zjo{Awxw$bFHDxyHoTIx!NIor{no2agKl?6@CiDm!F_>z$x7(wr{s6M*1b`pi*eFAm zH*Ui--MJcUVBIIW%d%xtR#5!by)=unM#ohkE)xt{6fE;u@qYHknaYyxLnp_C<-3;u z0RQBzlwyIaNarEVjm5`IbWNe1KS3^^VB6)oKLOtL`RuR-59OqX-p4ZXL>1#MM z_mW1j?S?O#7*=Jn`fQg>EcLvu#l{Trtd)FjEtX~8lZLoqne|C=De`+DqnnS81~W1u zH*Wy_KgJ@QXOJFfMbiFu4wx8Thi#Y4;`kUnWRcN04qwn(&IhP;Fe5S_B+i4Q`f-6r%O#u&+3cj`T>~B3@42;BoS+oveU((F2{Goq;eC&PB_1!#Jo?XP2cW z71NAb&tDPG-q0_f;v^87TvLrU`jkt|G~L4Rc>3&1 zO%PKnQ?p;(76-^%{WLDss0K4H?_|eS#i5__R7Lq(^@ZKaT$(2cWr3ye+sB@Q{5lPJ6&c+0C?KZC^#V#5&Jx z{+K3{GHfo2i%R+U@clg0*7$0RF^+peI{h6FIc1Tav1>$@1haobEe@yr-msVYqRgxE z;-mLdd!sjgHe8Ecu%mXhil&P322(cpnlZFXa3i&$!e`z*Ck}Uck5E3i7I31j#rboN zt4!{f`7_Oe$AW3wj3;_%+A#fA(od}ewX|+ zXvd3gKv4IxWhm6jrDU1Y4@FcRku2|}Whs|18uj6CJlFCxHZ2;w+b33M7<|K)IlwG0 z8O7Awp@dCil5UvDC9vyUs-7CHwv7HQ6~Cc42@_j_)#RPDK9Z`B7MJv*58?f6n{4Ri zGi9Bv_LU)dYNe+W!6@EdiY+FL7~wTlg(Kb-mq^BdL14w@e4<`OX}LQ=^^)n1@#>M= zH+9bL8$=Rf@~WOl7xkTZe7pC&XC;$9=&7C_5BxjqSOxib;FXA`J{{UcO_WzesNdjv zn7*n?@$`=grypFF5M zR%5tK*gA-a6qPAeFivZ1aUb}D?&c3WfFC{4G5n+Iy^sR*X#>EG5`phEwY`^@i#}R) z{_1D6*%wiJIAtq7%-6S4D)voY&qc|w+m3vsF)(2zv!Pcj@7F4Ia@emhO#4_;ao-Ep zNy?yuaKQi({fE6&@%1itvjd^EQ91>ZW8UN`c5^94FNI}Bo+#u&PEl1>jSXlr$RtW@ zkojLb&)_}C>K)E93vaA2EayrO<&Uy!%K>h&n@{$tF1qE32pTZN>}-N;t_0m(o{(SS zXUt8_7PbjnUDRChjcHBbz1Z6vcU|i#|8+Hsx~ZOfB0)SoIwvGtTJwgjy@2$6rh(pj z&mZ3am}jNk`!S|0y=XkvHE#FBxy?r0Lj2Lyw$-h=S>E)lG&(yM?Soo&H3tp7SFttV z7KrcBn67d_P>jEn_`6Vv=p&m=2jdjRt7*^gM(c*f(id>UySfc+U}ri-0O&V(ib3w5 z`&%B&Ty^uYz&CwXbvxLbxD?f5n9%X-(*0HJ5pGq?qtAQ440)j1pVTl=cv4;lMVAMa z`=Y`@XHmSYZ074mSFZIeALQKP&6YzRP1OS)wyXOU*4ZA?W%;hf7S+5TXRrG%Tw03Oy>y=xiKe9O#0$=yS@Rk2E zv*#pBvMnQ%`3|is>tF=W<=i(T*PWi01};`{i$cMLL(O(hgx`OwII&Pe){c}Nrb~s+ zm1lD$m0-{-bF&%dU$9hDXvd?z5^ec|;np9|;^k%{nH^4NcEVm{_h?29jY+tc9MQhg zUmaf?(OtNI_~w)m)#mDB;(rSFc^DnPKn&Q&c_gR-SF$o zn)?P|-wiF~)h@w_C!JNodM{H2~PjCy$~) zk8#Y19Xp5r7M&uwS0rgr2nbKz!bXTr1YBgLgc9%jddj1T4H<*Np7;2N1})eXh$p@L z>Ce7}4!dFIXvo`9Gh?X+Aq~Ts85!^y(|qPwQQOnDXJD!H(DL5?qNy`ry+KTB{n1G% z22pl}^Jv<;X6Mntr{12`gBPTbHo)Hh1jWdZDFa*j2tIiLryz`*19O@D3=NY>7k*r65MDdd3R^jxtoP_%I=I@P zpf176)^Lr&k>|;`$pdGXXoGyRR{q-iz6mCb4LLj*B5m2FQHvf=D9VzyQQ*prAo2-m z0Zqb;7o5COtdL8TBRjt?!ecm+NVrA^rRVNyi_L@^=Motz+AEzX15P3G^ zfuacs(Rs;*0JJU+$;fjO)BiOjEv(gcD*92W`Eb7mrv)g%b&< zbE^FHOCtsZ&Qg8$C`S<9HC0DxkRpFu{SA5U?B5CsJ5$7c|2tFR7OWcz$o278^%X6= z&0VDi1SMv;5p6TI5<4d82~S`MaSJ*_1YLI(jO@MCarZn6LPZtsdh+Fy(wboZIzkJ> zcAPSMyyVsRT2GOT1|$4l#hVZ4J8a6A>G|e_kuET%w=qfZrJZ9>B~;J0xZ{XXzuaei z`%5M1-*e+1ouK9zGxe1-@{1?`5%bLd_mUa$5fQk5r8*VgEpFDxTmMe+(-PHe>iPVs zUS4XucRoJ5^V#iuQK@v5In)2WhVjl-yYmzObIJeULiK-a3=5XMg^v|o$JyK`zRGQL z{C1L3e8>N^%y{q-C4*#$A(>)xgIz0YGdm2}QvGNK#y;zhASQo#vvHt9A+`F=Q0JfbC_x9$}m zhN^+BoC=X%u2zC6Z&AiZ7UJof5||SANg*JDU8nbVUhK>xVKw4$2nl&sQ|}-EJ5Bvl zb?*XItK5YK$qSUbs5Pu{%1NxK3^sfL&{p&Yitp&W+u>Oa6Z>nK)&cbU#BmDNM1u#{ zGS%F;h2cCwnk2_hrsl6mWOkys_@OP znCY@TRRHXxb=WhLyauv&vH$TGexvAm?}rq^Rmmv86m&kxV!i~NrXqWSD%YJG0>KST zK>y6-!-bIkkkR;f!fZ`(X9!G&T~RK{4B`VXJt77l-ZIM(cy3UXHxR7h$R?ScBL;ec z7*~VMBdlOCuRnXIN=ds`2*XBR8R7hFJ z>R=Oq99}6MH3u{<^1+vG`3-KVCueYhoU4c@o&9B+{YiGDl`mV)x*s0?SQz29f3K}= zVR0Oxet{#FqQz*3D9$nSG|gc%k_>h|c#AM1bkW2Xe}n-;?<5Va7BF@+%MKPvb&vH5 zshH{?N`{yg{PX8^GWY4lzDSDqX)pMTME*$Tya3$0L{;}^LE|9>c(v;r8+Gn*kIrkv zqK`Ugx`NJrB|nT3cD28B%ZOTY-+}3KG4qx034PJv5tz74rOc;_uRdf;IkcC=s9|zt zr3U;)6jEXBse$F{XFqM^YlZe4*@Qz<9!tg)9JGiQOT)%*eT!e z>ccjex*RxbwvZ&kkTQUdw#4g2bi$DJ0UB{qFyB8`mXq&frX8Px};x4Zhm(DC* zVEe5hDy5g8Xkg2%Tz$6SpTa!Kx;Eu}H)o)73rT<=R4lQ_hh$&XSq{Udr+&L--^ika z*12OZOLO^VVP0HG13%$|10pTCMk~O{0kej)TC%5+n7JXc_cX2md6dLK$bFvka+2d? z11#bcFgj#VIKm55_8V-&6z7WbB``cS!C)y!{*gV@gc z=a84Yum2aYBB$)cKUS7@91h51hSF_eu?pHT6Lo=IWxEYz6SI>RMM!>)JH|52$+%hI z+eA|yg&WVjI}cKwN+weCMB0b+yzFOR9GCjS8c5`89TYo!5~IOk3R|s`cNN0sjd=gb zn^re@{Bv(-R^nT1tj-Q8Z^ff}va9YOT7wC2g3y)WTMOPj8gaP7@J^Oc!Omr?yU zVH&0>2ZEVSiNCT4|k+5lQq{Yi-AqZr!bTHvB>IWCwTMS zTSF*RnI!+iIOrCLBu&{n#)4h}DsJiq1^G zODUeXbtl+M$WqXG`Q0hx2o2J9kaRcU0dQ_JI6@~AE=US=A`JnS4EyS_NOO}{^xP&R zOByEhVDXtT2Ex*35J__)EORh%9V-1(tbA2|^lwA6=onz($tJVD9fzAO^O$4pNX~e1;Bh*s zBYfThg1g_S58qZdiXSo|1I&6Xy1~~djCq&Z#OWec*f$B#;mP;xH52~M3J;OJ3JuuN zf#-CMZzs%+`vShH++FFolQpj5>B&;o@!s3*NDHguffuwTb#~&yp*VDHrmcC&yFL7w zlQ=k{kg`8AUXWR*%+_-xh2H9)M-#m40};(VSVe&Rj3~HB**XOL;jVZQWYKi-P>_Hk zrOzAc;f%{=z6QV+{vO(0{qnmQlT?WG{Xp4(-bXr6Fzvi>zHoPo7%?Ga?=3Wx_r2)% z`lm}kQqB>8RD1}A8kR$nNtt2#6)SUW_A77$^8VSE*w+D@Hus9g^-_&=1eown7fGu( z>v1bk-Wg|#^$MMPxNbxXhNf-r)l=sT`8@nEN+2frp}I2OxU#=R?}VM-7hz(FPKE71 zT-7Csp@Po67~WC4i`W1E32#8Q zvIds1J-tGnFNuK@5%yO4);dCQzr*%4?hF=O@^qz&jOGUtVtfU6cSvP$;X9Grn!YRQ zoSEt75FZrAOoVoV!oS0AP>P$+J`5MGBMAo(-sN)kNWKI&Ab>9ERFv zfBObXl@_|?d$XKA74ZD}W%~IE!gPGG^H^@_lY^|^)+pS*IZMcuz~z2Wah_pP&`sWw zx=(LfG?Pe2^8@JDMDtC|SZQnw1BKD;F;WD{C$7Uyl@5!^n;MCueJRfD>*8vufFi!< z$JdXS{t4u+l&MPKR5LNQK{#7LtW0sFck&8_Sn5}zi|CaJVp*0Cc8nZS zyPGpq9}Y6mq$;Wj5#I46sS_4fIFQgCT0+Nr|24D=y@?k2QP&|yU2%Uxm`K1RXv|EV z8EPa>M35`rh_yeiq&{bBm(Cqq=)}3V?&FOQ>IMamF?j(WtcJDYoke=*6P+Cu6(j(v zH-cc|mT_kcKWK_4+Fy&S^^fF0!B@EZ)DX6B0Dw5xJ4uq41IyH3F zLLphtdiSP?0yZt^L!9<=KePYl0y>id#ak?nww{XA&uo;I*oT{@UR_59v1e#S9XQx+ zjx^h8T*Gr8v_zL!#rs~+R{WtJKpfGhr zVkHy(nqG<^b|o|5_(oZh#Xs?&{>L9!c%e@KCrbB;O8e zGFQ!Fh3TGJ(sZG);M;Zg3kYRBE_F(az`bkyS067GPkBcZGGcq;Ib)t}#?n9NSH4E3 zx#JKt)om0J&R3!~gc#x899@dwy0=-{Qr;PYNpmt0zBUZIeJ&no1SlrzZB?!2E~`-i z9R9i{=`E}n?Jos9>CLM!E_LP+Nrwf8+sP!VVd_C%`ZjR>-rJ*CG(HVTTIpb!11?0| ztc!irhRI2xBh}(#+c>;2<~3!0!FP9`Q&H^?o#z02)&nrLl}Sdi+&!;BvBSb=52*}6 z9NuzmH=+-*E&u4q#G&M0Tr3*AEl{q^pTMWDz8jNIK24avd*2z?6ILV`zeEEC9G8^) zew-YuOiY(EQFw6^bQVI1j|(TCU9~6=0k#W}^3db%`OQbp^nE3uXM>cry~_wZ+~#-z zB6&Ol^q^EH;g@0B^kxe=0w0rI?=Px(VH*0#)9AEz%rXW?>t>h{zf_AHd$Zt>?5$)mj#EN0iw2j$xf0d;Pu`_f zj`xHved-lwHPgLY1Kqi?I|26V)x-3Ac2`U4?!5YHVx63Z} z=o?AY>+O8wq)In1^DxFJ4>m(qF)Y2l!S^B%Lm|qxH{qY^y<7dms>@u3Ip%(QAd-ZzEYXu@fS|r4Doso6|T5fNoBet^3UT{ zF^9?A+}yDQztGW(EluilH_CtF{&D0GBfOwp?6U4IHw!#W)@rTk@Fh<>{J&b(1hQp8RAc(_E2ig_m;T#0;$dHP$j?;qHm&N>dZAkWIl6Z~zXV+j!oR1@OBfurI;kY>hn z+Itauo~?Kf#Y6S<1wu#9^sasW>zgb1{D48#IwmT4{s&*ZP+u(pu9@}pq7gz0`oWho zER#6jN8T~{AxU+IE~^FpJrcipnd!fQZy}?+NNJ?-gMgrlI(1t>awWaKW>&5=*0I+% z&qBH}y}7@u>MMO4!PX{pll4NR)({L!yGr)c6KyY*whsF8n?Llx@QP(WL0(qz0z8fq zO|L6bdMVHmXc9|SZtkUf9MA4Cr837PE3HEnLCrhTPoxFcG&IzCl<|bh0Z6Z*AIV)! zErI^tHw40-g~&~Y=pJOi?`(IA{m5xLB99w|VlcbJ7Q?JZkD-cH%+pQANK1v2n;h|reb6H?{rpLrl26^IZ(THPlY*zyS3LN4f7FVFJ4J4_1YFxF3Rk;y+oPP2KcAeu5;G*_^xO ze-`u;4}x!A>;+bX&zw(?zfl6EveLn*nM2P#RTW>Q9?xx$pwCO_fyXo|icjhrE2pz3 z&E3_5ZvG?NVbPrz4@Z;^aEtGFy99qZ??Ib0bqkQ8T8K)6lh<{)S3!a%+ed_9#-vRXiHU@PpD0j61PMV(ildK!eD1kptV?$R$Xb zsViwvoSO}%+kgc~&Og-}%89+7d@ML@YGu(EAocO{9Ci9Y%R!b7^7M$s+@<=QS;_p% zd|Y5@-&C1K#uktoL&pyv!a(Kpv=1fq3nk14-@RP9v!*igEl%mrMwu0l5Qhk{m1S(5 z*Y(7pKaH_8cf|P>DTZ&=2+92Y@i#CO_lLuE&rr~)jI_owljd~JJx$#h%qVv5bwbWh zk91M}BLS2&ao>aM)n9zdBnUO?1q`W(r%15EA418zqiHPQiHxpMZu_yzX~;?61w=H& z`5=o=%^!I%-<|!CvX^*YH#`RPKC)kDaEWWOX$D!(Ssm)5VAQbc zo z4O0}h1rtP`3Vs(noO}a1tr^*Wy~#k1(;S%XF}0BnW%9wo$u)om&)HV&>0Bm*{yB*M z(o?zO5)pqzsN?m#_lF$jjD^NSc9rseOR%DikTLSv8G2tB+Tpu72PQ>Zn5-d>T8<|< z2%z)lxjjP>Pi`uAOaizG^*Z=XvZbGI!%CM(YZKcgQ4f?fsk_pj<20=n^n${;?S5Up zKyk_9E+I=?=_m3An+X0C%h)|6I2W_0K}oQhom&g#2)ml@@juz?|6TT4kBh4Hqk%LK zQ#OAFLHNC(#t>1&EfvrPi>@9go28BdzN1;Vx>_o2F!u%Dor5#t`}di(Akt9(Y|A8~ zTlan%N5EQ&4x4>>il(e@fk10PLD-l$ zvm5rmy6Ly(49I&bQ=TLOCUN5~g>Wn?0DsdAHviUy4gj4NAjva(d5>*ph;kqzq3^t& zw;&Zr;Zf3@lKXATkpLkDo-{b|7nam0Xwt8i0VCxgPmez@ZJmnFozZ{-yoxvy4@e3MPA^5tp>42!-QhR zCLLGFlIXpyLYqDN;U9PNuC$OyU1jGLDAGqAO;1q7p+P;0b<+1 z3VIntxnW{wHyrAq`8wcaq)eX3a5}7`c&w@t-k+}_YLK}H24WLfbY8J6{Zqc$tD`s^ zVW96)GH5L}d}#WdpXWg+?hNEhx({Htkp29lX*Cq3sMom9w~FsB03Pu2=G3cD*7#J3 zd>5lbJ^~%G1y$=nPT~MqSTig!*G0qne!yc?Pr;8!U-`^9F!FTkA*w=At>FWiK}T_9wasyG%kVDU=sadiW8U{8XXAM8 zaVWU?B+2rqB6Nb(g&iWjB7sq4{BISqtos7k>g+VI{y7&7Z2JY=SJGSk!6dE-Oo%H8??{lI4{Wk#eRDq``9 z4?Zuc%NX#+w|~6_TZU?=u*=FDlE)55BYz$lDevM|yg_IBb}cC&!f`aTNG^biey?~|~2n9Tkn z8n#E_@g2Mz1^rHP?7eL2Hj9A(NF!|Zf=3N`8t?#eWFEcN#7M+|$Lr}<=Fpc84`$8+JjId_c;xW69Th?E# zZNY=g64zC$hYZ8Xvtu6?J`K(Xi2ckO%d&)@jvLUGCJ%K@srQuq$pj%tLrTSH6QJ ziITNGRupGUS_j|o54DLC^$sBQ>q!2Ykmesb-VleIsXlE&k~@BxzzAEv;8_2rm~9Is z^NB6%nqM_$4<4YNFdg{$L8FouZDw%9b>fZwH*)(laLbvD2sRYtnG!7{JJBq1njmWN&usz?5Zj7~p{kU3h#98_k>`N&sS2r6vg|IR?DC8+t3s{3 zenbf&LWC9ipWK0P4sxW9Rq<0=NN)gOyFtWxA|%9h@}GvOD4GLgK_;>C+j?XY2)E4w zT{3Mf{>p3J57PNZmQ45~sNMM}vh-Gxthu7TwBmuBj?m~y@*a@VjntAMxPBK)?xbru zzT@kniB-T%Qd8!%Wdh%Ux^|AG0$}HV9k;{AlqP~U@jxBeTG@wgQHR~r9cl8~Wa3U3 z!W<5%Shhj^+UU{^f-o-usOy=KG-I z4!FzDlKqR~v#`Ugllfc9CK6viV3Uy8=J_5kk8N3Yhw^6GHHOhBYLv(^L-J|A9Z}5#b zGU-|OOL+%Rko!kvuN27za9H-3=a}WJW+@GvXsaPiM8JI=N^;!7LVHA&hwQc*6_1aR z<;M}UH$AaON1)aeu`S=T-5uTB5*wsbmUVk{q-aePHU1r~uwBGpu*Z!B!6WsC?$#!s>@%n)x{&7E1y8R_+03MR7LVp)_)Gj1oZ) zb#UgONZvHvnt_QeP)jFa)hFiGbEt|3>~N*%5WR= z^gU7b4323$JEUH6D=-EznT<+_lnE=gr8piOo1z3keuM--QAs45uyE=zv zrqao$C_E{4`AY=fe>l%31Y*s4HB5{0^V(U^paD)EzLpwEHopbQ zy&SM&fLcQO;)Tuv0WiB&hqG;ALsb9l`+m8aGDOK}BM>_aR+w(ED)=E=E4M(uzLXii zf0kH-Y{e1rkmfH7?FgK+$w@Zz$NtZBwGe-ykKdgr^4M#Cm0f0*0?~OH%56O!Kzdo6 zWS8|Nd9^v(#9KMBF_W;v5Z)`a3Ov}VCF4Bc_@h5?{Bmd9XJ!@KE}>Uf3s2vnr{Wf4#EO5Qs16dw(&@Sg~2aev3(`PZWQXzJRBn)UlSFoGZe ze%E{~TE(QXLGdIHOdMSI2IHh09Y5l`pmA?IRl{MwrA|*(kb3;{f*@Rn9qHgZZ&L*u zKLr6h@}W5>V6;5O;Kc1!_wdG*>$;OQT=(I)or1*J6eKy41%B3yk|%DWAO~mtWvxQL z1^BBVnMG})VqY4i6!1yuG@0_hk9#hdK);HY{g{}frK-D9NCCiKnC-9I2gd^$wF#+- zEh%~13%R{x6`tz2`yfIG7`fCx>%25f2m1IkgKc~BWWSVCZoTQ0wqSEx(>8h*Q z&ft)2L2vcM)6!C6_523*jBqU;sVVkh-vdn^5R{&IlxWr>vy~UOJ1UjbUqdRaD!Su+ z{gmrQv}2N=`#so7Lz(0o5yFa2Ccc-_tG;UgVQk9Ld;V-AC%R@WyRc|^n0XqZIA2|m zVpe@Wm+L-QaQhLP#zFIXG@R5?>%r2+irzgX7-`&(S@vchaQnwiE%DHE}DS|4q8zvDcX zmi_v&riRzE?ahv=-;R*8NVg{w9|I1H5)Ts$_{(O=y#UxjZ%~0j|60f+bl;QIcZu3H z1(tO=TG}0}gE|4Elp!akq4a3z;c(aC%scOZ!^&t8S1t>`2aPR1pG(h8k0m>aK3tNU z4A@8j!;U>bIBg*E=ijaECX&amk2Pb5xv7AdgvNcxsnXOR>nr-`qV3Rm-*?`w*g}Q< zfl5m!Ch5!dSg*GRsVuHxEPKA!w56#R@}I5V{4{-y19M8WUv%uADj+QmQXAZ~bZOWm zN&2?2w>&brDXxG!o*-d**>(EHhxO_>lMX3?ZT+McLVVUz^Sn{<@R$RV``cx=od$k3 z)!#2D>*&${dA^n0V(9Z6M+&5w*!-341jlUw0|pYCUl#NFBW}zzZ)`PyA3pe6nL-7a z!vGW~V;akfrj9|R&FaKJnOk`k88OwRiOjr;duO0M-$ibG_I11vU%CWleG9f?4)(H^ zdwY*ADxl2A?Vm$s#YE(*_!hJVQ07$gQi|q8vBBCE^l1)96P_QY?oyeO_3V?w1g&g7NRo)+^uA6-) z8mBr(2s!go#nbEW%OHEwV;kTWzwds#q1tSOJ}_*L8`Ty4gA@om>}2sP4e-(B94mH#$a5-+Jn7K!FzK!&dQQFGa zz9Vwo{L$+Pv!JDam(N{oIv8uBw3Mw)n*O2QS2o!lPMDbuk!Rd17Bq=EqpXaZ5>W@MaFy#sD zPu}xdK}lFeKNLWra>*DMv$qb#Fn|a^0EhfAP^!AZ9I%KcA9&~>(TjG8djQbwWnX-K z83E1$BKng5juaj6+9-3r&K7@EyxKATo-Y^VdAFjV1H!1WR|44r-t>B;oTh3S}fX3bJtkU~4Fv z8VQ~jI6N^?Bn_8Akn`~75|L8S3G!fx1-6<4l7H=n4sRh+P7; zo{J>PL3xMxyd{Ei{2zBZQoi&5MDwh2mcHIqs{OrZzoUqaHHpe)9V3_x+dHi9cU@}{ z0cq_;Z@V9*e{&TaS(^)}ee24V8Xq5=u`7IQv2SH&aL_w z5myVZE(C%w#6;Y%c+2a(p7cffh}iy_u=Xnb#=*B)?=s<;Q6Hqm6tbK8W>+~yZrzOh znKEM_&|KN?lFr61!?cQi7W@0IBkR$Z^#MH&E2;;hcZ2CmJ!-z@_wBi*9IwXfe}0_# ze!2X+ojhZIPcK--XY?{!6c#M)LDj?6^Dg;cf5*%%3f`;etM-Uav1pM|8pU+!%2dC* zlgHTK5p>gUg3ErL+O-7y=6636sOi#onddUp&l2B?L`8*&^|`+vt0`{K&O2Ju{r2Le z%90W<&5MmhPSvoUfv(B>3h&e_AC`6h-6=(c-PE@I6EU}1RroGveNR=aUGRHb*0*SF zkI9ADw@sN@+pHYj0B-{iYGGxiUmosqw^_ra?iFth4)iX(L+FlqVLI!8<$ej@+`|!w zUxn}5SyTcJBJ{yEE*?^8_Nc{0H>mZsP}TR+j*vL#lWTp}Sw^u0!bPzAIo&hIhrGGDw9 z9kHKZ{FyAF{`lvwgW=Ddk650n8qE8W|CC+}`tcdK8!5(r2OO-fnjq5I<&QQ?pUcNS~Zc-q~1Tx==J& zdX^y(x)FdKUkLPU{o@~7tMEG)o6*bkKE6S~&MC4!mg|zD;_7|2>mHjyp`aA&V zDz9~Bo1F;2KwQB#q4UV-}U3&!-&lg~%zg4f=2B zV!y+r&af@4@0=GjVe&6@6BSA%JzlJr{xz$x;q@aoM+NcQC}qy&ynXvf_|r618Cr^! zrRxgw_4luPy&HY{0uG)}Bb1$w_H~~mO%oRP;|H5jn=|ZD>okct zRZYHbbIFa)#f0xiUL}lS6+C_pV()?@JC-ZACF%CYXX-8QLOo;>c?z}MGf=u}i#o2M z*JwF9pSz7M_}oo<-#A#vd!Wq08 zd-4SpF6dk~j;*vSmoDp?+E#7ws?4)S4XSa+=Y1#(jEL}`i>Od_@{+S;>-c>KCRKdf zI?q%txDm6|qiZm+<(MoNx7+dXo97H{s(auL>kUO~DH&UuS7p|8GuOFYYWM9vB)_?= z$JHmPFE1l2HV_*BHm!YlYo$@)t;mjVxW#aZnh@K>hq7!0B1#(<3}sz9mZWX89AuRB z5F1$Mv2yuF=i}!uHWeHkY|NW>_qvD<6}=pO?Src~g25MM9j9Cq?Y>(iY(C0Fqi4}8 zw=6!7{xO}ka?_|!5XYC6WjVO#I0tiWWw@gnH&~uibc^;T&BO+e@vtOT;%VVud#tWu z?r!7#8Oy$3?Kz_9VanlF1xF}bRcc}Qz3@Q6J9b89FX}r^an`^8czko&6MNN2!?Ws> zE3q>(`P1jhuB17Yx4l_}86!5bV`95iTO10?cMX}f{dV@QzkzwIYB+Z#khEVBX2x^p zgvQB&C&!p6(nbdohkLD>i>R?rD6ccLeUfxz*h8pUKHZX~dT!3~VL-cGl=v5=oLYM^ zlME{r*J7us_X7)nTix%Ql$`!5-`SRMuOY`*y&lNgUzy}IHF`firo1dNI=Qi;8{swj z*KGHI@FobmKUO)XRhhXc{@hqVe0;~=O;A42Zke=q!SQ8nzQxa`D1}R(K+0~_JXHOZ zt)%(oql$x_hvxLAI$wX^Elb;C5EoxJc&v$6p~<9PI_%@*nVZdy!(5O2O~j z)**`$E>b11qFbfxd6?5RPxn%I?swg=n=;x;K(IjsOo%rod9GiN;O41ZraK9=@*<22fT zNfAH4JZO~K`AZD)W`?6cNaRtq^Tn@U9$$OVY;3eFHX{MJ^SH>&M`>l5;lo9&ZE-@X zmMtyIEmWzDZ$#_ME*kV83LAR17toq-Y4>6=WvRg=Vp0EI6I?kU%g1r-cKqCDjh5vc zyY`z&cWjp*g1@Pi&GytMzEjHKZH9t=d-t(0@Vk3Ka7Wg^r8gDsFBzH9R`0R5xQ{FU z-ahWye`4`?1Jj{KNYt~eW-i{IKKI#6l(zz`b3d4L2Q*f|!Ypt<0DZmSTcLI=+P!TV z`mC|zwb0fYXQAic55ZXjLPH{WV7-HOasJ99PxYee$z598`W)V~RK|y)goncIDs_3( zk`Gx1c5YEyCc-&2_$LMpe0)_yZ;0XlB)HL;rF-97c~R7KH}*-b+wiCOJIY_;lf*r8 z49x2b5o$9X)}HsZXg>UGXOaoaRwcfBzZRU#bI`{)VDL3qKg`)P3nbd!ad+;=@WL-& zsWw5xF(db8KX(^HY+r_-La(EJY_zz?hMCmgi{XpcO_t@UO;juTtZHpmIUS@{LXCHe zibOjJ8x1!3FFuUEDc`_5hNXQwjD6d=W0K*~<*}V{p{Kk3PgHQToaC>&;%w2Ea}JDN zEOVN_x_Zafh+}aoQb=0WHgOQ$;E=g4-X{Zh;t5^9Wc{7-#{XjOEu-2B+^pZ00>$06 zxVvkMySo=laCd8QcMt9wDDG~>-Ggg!C=P9J`j@#g^UhlDUGwRluSr(Uik|&@_TCSZ zx)ZvI=&4ImVb=Xhx(LJIzNvQF1A@(@2&~vL?Hg|>mrSr^LqI?x^mEIeG$Bm)cV$kE zqE;Il^nVvlx4IaP;R23K%F4bl^0_CuI5y=+n`HsB`cP!;{O&8UX8LjN@Q@bs=k_ZQ zv^Ng|`A-6H+j*Uz3S|{!#9m+P;be$ATL#xOm{d6o!~*oj?!0#EBq{uE8jmWC8L{kp z>xT}_6#>Lxz7H&YO2c{#ac8vpCd!t(*S2~2Zs&LjA+T&(w)Bvx)d>n`yKIT#cKNk> zL0sg-(NW#1qCOJjeUqd)l5|=Wc+?$(Zf1EU8mTMOfK|C)>QSghqpdAM&YSmPUUGFd z0=52AtM%5`14{RnT)hm+7f{w7krFVmaTOZPo2G5Y}GbX zO%E7vdSQ;2U_YgGefWR{1T41$0|)86iu+Q*{g;H60!jyaIHKaV2)X!ku$FUJ&Je^9 zAsbEb#$Fs{vE~WY^oy5zOcfKT$OrQh#6R2pXsiUrCGtX&YLJs-F_1_jv_>c zM~@^Wex23xTc`im*8r0q;C3umx1PL7iC*1RQty=94TH~M<&a53B45o6S-05|q*_vo zh#Rh3vw9`G))W2hHa-?qgYZi3mJLe?pRfFAByftS5+j=6eb{B-fmH)|v`*@yM!s;6 z8pwJGhalS#LI`!!#$918E9wZBjw_(08E+He{qK9FPg)iU@ZxHcdVf+@F!Ts6?kLNC zK_NV!)N1X}GOu)5IOWoC8QF~mZ$Muf&~^M^>Y}^*9egb4gC7#ngXiHj2{0f^u3+!Vvyg?F zb^EO3BcY|G1kN2?-#ad))s}=GnFE%F6F?d3*M8broA=`gBbDJ$9Dsb z3#^uO;1jK}DYb07AIsPo&X(uyw=$i!PNZLTd+_+HU}1OI?c@M9jLAlL6O8Y&zve4@ ze?fgg^v>-V>QjPw!%I*4KuU_`!B1jDii#wcvG=IUp8G`!%gHFj<;?FRP2Rf;VzT>D z;5+BNfdQhj2HSX2^8DQb)r1CI(Q`e7yz7KX<%bu$*0El=pdJ3yoK-#FzB#mKw?YdB9I@{HI1jElk(N{BhCV;&W@k z;XYvz0ARD$L5DC(-VIk z?bx@#(E`3-vsD@l7nXO5oOmOodKW5%< zi_}OK%~C)sGZHRg4ydK4vm^TDxVO6y?w#ITutUG|f3@^~s_Jt4x4MQx(!V$T?_{=G zxh4+GwozC<>5Hd5Lu8owk0cj^aS7Ct#Br|Cr~Y?Ux9;eT+S4-qT$$c(rwmH&=a*X- zZkeeC<8}Mz83P^o){w4_3R=Q@SITz1K_0%_Ce^sZdo&*pv*)y5{AG&PE32Ek7&VGh z8?Sz8&{3R$nRxv+edGiiC zEk7_#>8Q<4z1O$5RM5aBpgqhYc^Go|5$HF-omTpu2&EW@oL}Vl0ExMO4hFekuPi(m zMwxBx`Eco+n?h2=5iL}}O@RTm!;=@Id!DZUa-o*V_)l2(;yAM-PPp6s#0+fD>kq|j zQ~I6e3tB#5~%a+0T+-vA_z+ibjxZ3)^ixxVvw}Gu6TWn9h>EYSVODzL0Xz@Vy ziuX4AlEv<6w{G6x@E`#5y%?;vX*7xKYDCZ`Z;yLN zF&^UlEMd0)T8X1@3#wck=5O|b-vP~#O-2X$FeSg!$tNiUk2VEXKF-dsuDubnuNP=u zkMY4mwDV&$02pwn&9xR)^!2~Q`36P8kYA}=v_8n{&KaECFAy?FYR}balKss4317?1hKq62SEQBOG$=Wug8pK@sw$%@o!(HYU(2F_RoFYSClNIQp(q1|uQ}}0Tyx!hd$zxla%KqHQsxb-MNkNme zaYM~a@r=Aed8bT(Q}CJo}CjC zqCrYpvwat%XWf!k*Y%m=?=}JoI!i0YX;DzU{Jhwo)@758uE_4I70HP+r2=s6wDlEs zJR>lK`1T3Qh%P+ms0$x941(Wj(toamva^472SPPFrL@2qk3r0{ynJK}k;6ULDLiTF zlA(!)mSw&*&2HxLH_wG}3xrs3)v7c$eT(Z&Umu^J)kr_qZry^9K|=$)qq9^PGMqnf zxadaMiTq(oQ0sf%(t4$p`o0>Y)@GoGjQf5vEEnc!! z(cAcXGacCcM`#j7Dr!bIMt|^8dbdhYf!cZ!S?{}&yOM7V;j5Ux@Gw(jn9@SjTW4Ks zdmHw;&7y&VRd>-;8q+lVdXcg@lDtteB_0FA$qp13Y8*H*YKE>=Z*--H>}zHkg0Z=? zPldv*NxXs&?Zqu&K@IYIH2_cd`%dN8q@ZHP$vEG}{Y0)!rljE=8wVbXt)R@9@`Q4k3+KD`J7TW7B`i7}bOWbp?Jj0)~{J2xl41NMDTL)^DIy;0SQh23`s3Co~; z(+HQYG$f>hM)=y|@59=X*pY;ST)NGL(FydmF7Au7h+8u%5}nEvH zw>)5Fl0@XR@f1sGh0NubCHgW>K@Xu5!?R3Wo++4d#UGezfJQwt(`l;&&Xs1C7%3}z zUyzOJil-SjugnZuxU0&$lY5A)zjQ%y73%d{6-O26^_iKO6ANrFK3&%<#r}^c9NcZ$ zY1S$!jm!2$yFlTcyQ7X_W^RLQH0<9?93(lZ^udAJ7OISYMgA&S&IVERgpeo}Q9hV3 zJPRJ5kAJW_M*@+O^daw_!}al3M9)3@Ip%at&Qyq zbu==v*wN9*4=jLZ$nmxS+9e7q*gY3+B;Dn$R{DWO@04 zV*AI_>})QT*wd#^M0RN4N{CfeQW5$`Ua!}1nfTue*lBcSb^Ite6n{P{1JwO)CgS7B zeyLqr(IKV{GiiAa=f33n-fL?h2c8K%+Hw%n@s({u9D_g%u89^8LV zJ!PIEZIU|~UaV~rCqc&&&oyFLwdx!?S19AWMffEKyEWf&VSrHy&%dB5y14E5Q8nWL zcIo3q7Dl5-blQh)dK-1KvsOSGN}{T)C-fLu_BObJ1pQdkrRcZq+% z5NkL2Xn*!e_xr~oraOHXsyqNCm-pP>U09GrQPJL0oeNjaAWa&AF(L2CHQan-NmP4* zicDnIjnXrr=#W(SFK0Ok+oimi!Ds1_J^c}f7GFfNiD4VmY?~0LE zkQfOkN(1OBYeWsP{T65Ty!%8=5Tzq<%g<;d%R=@kfFTY&{IQ1wJ7+2bEN|JCwvZ3u zev;*0C;mR-{H9?Bwq!Oz(ryo$cN2v~-Zc=u=tEPO#B>ww-0 z{GtKi0P!QIx)Yu-ehgw<`;z~#74?*)*(`>^)vI4g-|mWWaL2u@)O{U>G2a4X6K_XX zpWVz+coHRbokKnacZ#}2QQa#eFoR$qi-!o3al@PHMbUGtPD>>#pLzrOA&bQYAt_YU zg7=RZ&td#<8DM+%aZo=?ovd!ACPEeIt*YOL>_E!U_?%8naKTmC5exsK$bi&t(%UcK z(!%b$xl9~Fkqzvk<~9gw!$1cw zyvzvCZ6}D`>^yA)bY4S7Fbt;?u-Mwl=cJNDyPN9!?g+Mj*T&w6%{K9$Gy!sz`C-60 z!ok{ocJK~2s~Gp3W#bbBw{6?HR`b&1!o8?SqD@0!dG*WEN(wd1_6BTJd%oL0*Q^X1$eO}tE=Min@L}GT^RxCSn3iriCW_k*8khKQoao5NrL6a(L z@z2hh(IZ@A@~+KJ!$Z5F^_i`&tx>KOU&oF^$v9vh5*VGYOI258B2S~A`cgphsC|1; z>3^vL$BbnaU+CaZ!l1(On=PW$8)k=H33-SrUhkcNaRCpJ!xjs9iK2c#px3OcFj|lo3E}tQ<9s1msHf}*-b^Wk{j4jUUKjQ!4VlXsUvu=p*2V< z;Q-`54)`amfQt~Kyxx{K)HEhAOj@$ii`;{IHKw0-6caC6EaxOiZ>!MgaPofK&*v+3 zK678KKZ2=l`cvJ*fP5Z>@U;*c0L5Xl<~{par)jU@s}nq6%Im;MK#I2fONh8~Sug^r zE)k=)W%-+)-}tlY$CSApmp@dmMxR?E~l@Eu?;^~uUb{m#E3fa{@&5e zp#02QC6_+F?8m6mJcY{7z8qA%HXB^x>yhiXRI$Nv!b(2Awl9I&o+4cVu|ixT0)%7L zHeEcx9D5W1$b^7%>ROmskG_6_!!B^Gka`f#j3IW1Rq0fG84C_>zYaA0c{gmP2yTN;odIzL$G9ck;w)3H^-@=w8^W2exnT{?7P$0_- zPw5hMQM|b4Lk#y?hXr(8zBuc#zQar@fq!50dZiA3nOAIF#Qd$a?{g5hqvtk@LfW3l zVCha!-}mPdUG+-`n@wxuS`HdsFOnlJd)_=u+w+g74r4(blrZ`9VlA}v#)JT?D>ujm z#8_+ICNU4Ab!D)a?R)K_Tw-J_I_Wfji%`}U8+mLJCy--it#)pzHOKEY?R*!?;Utn^(JYstWYe^PjI>4Hv%0MHg%mu8taRH zJlu5L^MQf8?6qsKMB)4eyN&e|4i^R4ecn%ii8u^ebQ$&gTtKGZGvSoNj%h91@@Z7j zy6j5lxFQ9O)O^TqeYy?>zXfay7M?ZB*t)6egMkZN?eY@YC-1Zo%LM)bDsU&D&Z|Jk z%wm3pSEs=*O$CYyc4qhFkK#b356hO0B^<)sI81J^X(6)o$^stUdE%7h52)xz+U)-W zpE0`L9yPT|pKscd{vhgu8E>01NGudmV|=&`l0cf(ct@5#KMT>H7qf6;&y7{VBh#02 zbmg%(@caIZmSZ{FWNDUML{?eTwzrAaY4A)J%uJK6gBZJE&F7T7AtpfMWV$6_?rLkK zW#Po>(Z#o%oB$KPrY$3Lk4c^<%)?sdH~1ff$DxGdLO^1{-tpWjEjq8Sg5KW55d?X> z`ZoOIY|VVcnVAd;PQc)I7AAQILG!uu9{x?soG!0=IWWS?1JF|K#}vDx@!NJYB%Zmf zN%IV3lIbKW;S0+4H99UYyZYU*S!!qw)hh)5u8%;F*<0#zEBF1(`8Hh5iEIBQTOe|l zi>~l;LB;TmlL*v*423B-N`feiym&hp_8yIzi4EN=%+%1J9NRx~N0gLuNcLK`MmZ2? zmTSyER}~+!31Htm!oB;Cp0Aq!gUS5E5%GVmPrvw32w8evQ4Zh9@!7-Ff0z<^Sg-jl zCpEX!c;t^7X8Q}}Kq#WI4L?m4N>A#5wV9pWvyRJ1yY_3(x-a%yr6Hx2wkj`Z&!p{q z2OwWGXwKwo)(p%yP}1h?TDwxR?}uwUJ3j~?*5sdEYB9oQfpfI3W<|MtlxcPj@_%1tSP z3qc){H*c2Up`%N2YS9xR?0t-i+GZ`DR>P>kzy`&znKfu4j0F}S;aM1kjj=+$Yu15J zChYa{hWyKfq@M)lEtvN@*J{Lu;dn36lVgQxF8 zj3nm2&#K2$QJ@xs>ByH5kDFU0g%BdSHTBP2M(*^jH8*qb_0i` zUXDb9ns-A%&dN;tZrVMN=QqToiMSUvKRhdBKsBT+)1#7@CPR)7nBr`-ov?aY0ky93#O|n$oWy@ zWHUk9TbCV=JWL-acXS0it|}8gf?Kp^i@y)ib{17d;uPWin+4zpklM!A%;`gvvr?DT zTOAc6a)@tYG*BOetg&WaF2H?H4BJ0MFr`WveY=J}&#BW742gGZbkny?bzZNn+BOs1 zrKVsxK11n9CI%fQx5I=D62)>Zogu%75}D}vax1R!GK7YKd>R^F_6w1{_}Uc?Bt>swqeZ_jTCc~}hOY+MK|`hs+Y5(3ePncPqUUEn zFJSpia0#DS*1u5x%f{}${T$CfQ++q{ z8*t&&{JJb~F61K;{huANS9hcX@}%VOaB)Kq$6|4c&CeBcSaq{pGC?G-LZXFptFFmYC9j z%f>KsW~I}yXt{e={d|o}0+h&aJ) zv_zhfT@CF|uwCL>8ebX|Wse=NoR_=SMVr9a7gv=jrqmkda~4fvp?Zgfx+o|GcZ?1K z=ImDXVjb&Oo0nJ3Za_&{Cm@gcYT%<{Lh4uyj}Q?AX?lD0am-k!Wb>e=L7^|XE7^H& zZtZg|^^y6gE3x=awCL+WEB8NwoeW;XU3BfO)<0GQYa> zFJsuolGj{1AJl!q0}*_>j3JUR_4hVp8s0e~R~jQiZw zbdCQYEO{oX6x%rEp2f@Wj-F4UAJI(A)oXh`MuYVJks8Y8W>Diyj?dd6k3O;eCOp zEX)_|EIth?OEnJ4WguD&_R*6zm0lA*qME zb*nKnFG!)j$kzU+@9oA%@SWa3-#$=0OR;fh^fX|9LoQR#GcJieeaq0x7m?C|LO`Lm z>1f+wjNhf>L1R``m@IN6s7?!C0^)}ZG%FyuWt>O^Ez(9Y*EoQe|kYB1q$HTf`j{p>wgFg^dth)#Oga!XT%^!cuqZ^mLO?{LKu>EU=7AJ&c%Ge(WK@Z+OQ4NMrV*srLCgN*jT!1U6WBxEk1Ylu9e^u!%rEUAjWAOKkD3(1GIMLKa+9{ zwfettO|?IPhDNcdS@A7R603NuX^cvY{7=~s!xbV8&jcuCV{?7pZ{7Y^oG|aQ{Bx|E zHdWgsEz*Z}pp`x%>qtKfg|8ldbi?9W&#-DBRccawRgsy5{lG_Czk-JurM%FI%@~l@ z6W3uE!AEH1JeFQAKk&R!>k=xbX>%7nUQsZP=aB##&m9&TUPaF!(ftndQe(}fgnI-! zo0mRpb-6!17f_Fi^zkpEd#~KXL!|Q~_Fyda)N`JN`N1K)jWc@EdY&mmmD-?Z;3>(V zS@vcjo4L-enKIm#FSPUU4Y625GP6+=tGu%*A}6uBoo6s^YU+fGwCKfa-fj zVN2s09?%(DhjwOHcEhk6HcNh?ea<9n_+c1r!Gc5Ixa2rfWKo%15zaM*uZ|go8WhE$cKdZ%hMp1nMII zHTEcSJ z*i1A#PKq0{?03%Or*@1r<_xQ35>tR_Mwr!6jP`gB9yt?-7CkG7hG=q&~ znRqG7$_(NfR=&QuHp{G|8mytVmit92?rhy~@+MMm)xerLHpNs}f=u%W($+xhTNHkc zz1pzB*GXAbDje|Zh|3ZySz?25B#!7I*j--jLJ&yjS5Oren@V$M++~iDiWhWY&{aen=lDx0%Tlc?ATpc(NO0i=G?>pdj{<6;+U$Nj%4{o z99@^VkM1o+1-B7vx<|K^nw{`Av-hrJq=<>***q4Jb^IjCirdd??$4p8nN50g=+KfF z^)jWnbnbNNEgpGTnA}a@gNlT{Z3O;@MPpMcg%)T_M|wh*!Myp>J?5$7f>i`mmgEcg z6WK(MIWzzKI{va8NomIH6N(wgMq+w@I4N}Zn5@u zAYbITfl?z?-R?KO-0ESA*;iK9@8mMjSXNf9>q$+8nLpjp+@WO=K0H^@`$RWPmEhJe zSABrF$}Je~N+x>yus3jl8h{B!VO|d(stko5GG^UodyvvNM3|m(S$j~zjh5ZlA@wZ(W zdi?K~!$I`_Ni5<#k4MTJe?lT%41Ssmk%k#u&sOkuY%cFqQu1-LiwU8f*}L0pwoTiK zpKi7t1!UpH5xs$UT=Bl!775PJd4JE{lRV<+^kUHpJK#ddK#XDFsPzf<4Gz`g6Ewv_ z9{`<}2oQ)v`#E6$2Aknz*LIwih<|WehDC;ViRQ(Rekd6R)UG?srZdpwBKk^qi9UtH zAQ~yzriYS7CdM&J=!NBgZqY&>$B4?t&FE#$QXFsX?niR9p4(qG+$fn-i0^!`t`)65 zubduHLpn6KAey+OXSox4lfu{h5w&=-|AjQok7Ocwre|& zasn+lEoG&*^&#eCuKL^spoK=*%Zu~Re4$N)Zx42k5Epk}ZN`DWb4XZs5ix}qbfX{n`LG@?W;7nq{`RP;7%W93#SL-ft6s;61 z?+&R5{+`aCLfajs7)^awe*%1EbcL>c;gf3o)jpN6ew6{!p#p zaaPW;o2K^tBk1I#!2V?OQ~hueDLVHLe;|BmBQ&<)rS;=)Y{5tWuLYvhPIa#JK8a~O z_MQ|iTCPYEhM0t$6oIqiHLZYD`G~jk9d>4$*YVjmwhZ!MkA=my80a96s$d&3XLzd| zzG1om^o@V&J>DMO_I*Bbc-uPgw-2SkDa^`dGprvN9`-I<6S|WPG3b+~mXT|?TI=x- zQh=OqPF2%t>=eo~zc)(g@EJzG#^w&Uk=CV~XJ%VtZ_G=lE+u=tef*uBPCd*XO{OaO@;;;ug2OXh+4^w%!_?Ru z`Zz1F+5Udq zf3>WQk`HH>$DCZKh-2d9gTb!MbafpUjPRq_!O4vfP3BE-W)d@QpR{|#dN?A&pzj+elef$a#*d~U9@QYxiZ0XzJnExel zR|kIqf5qrJdH+LvJ2P2^NG^QbKN_D5yYY*b75BR_Wao`0X5Y`-P4!`sgL=4$Ks2ZZ z^|nf?@EzJnp}Q4}=RHf1)B}Km_unyo%(Xb>*(thn%B;FvAr5|?6cKW6sCslVL^Gpk z->sB+-WKPv#1JN#b3R~83gY(f0Y8Hd&!v7A|6~ZXUQt*>xCn8}D`G~+R!%@_H=jXr z`dJ*Y6C}3PrYm}i2^$%m!V$K^Nhlokks!`;CYGsnA2yV)ivX(8iS;)9fWHjehN|i6 zh1j9Vg5&@wc=>m>0LQqG1^(c+bs2k4-Ed(Kby8k7(a0FL0_W+Go2i(~kCN!d$VdbB z4Fu(HLfjQ0s!)^v`HBgxEJVFX%#V7wqygQz44<`s573 z1j{QjKLyzY#OcTUkt7#JD7s_g$`)nqL$>gkT$IC_xygMo2G!3U#m{@TBaR~+~-gb;YPQ{p= zNg`BZ{M^{9F&hynxo4Ni>yTm>x(guy5BKOuX6TeqBtB=GdnzZPn0jT(lckZ>W)m+* zQVR4sfAe#iZ?Y?!v@Aps!Lgg0I2IW>i*guo4bpneFtrJ3pT~+-8rkDt9?hACda0AJ zQ;a3%p8sWA@ER|@CR04|bceLquHux+m8i?5V)})QUeb6ODE`!XKC`;EB5B)rsj#9a ziyt)a3zddO^NIfc$I9)lv9U18fd!WU+A&Q#@9K6dKVsA=KMDQQv~E|KI*l#pT`Il< zt?6FhxL_gt^W*I__edEJ&kJahv2i$wO|K3OE}Vi}%NODyWp#UOB|K$W&iK#`Iv9FM z^{;yRb5rnP&qbe+C)1@NEdFVUp25iX!s_WT;gKMDRr(ZFR>3LRSv!iVBXTKSBlA(+ zES0z32+7{eC3(I}VLEr9YZPUKqP=8M3R|I1*%0)*e+BE5RFKP-TmQCk^uor8{Rlox zdWE2`@lu^*{1fPN!mJ?1#wzOwtj)&Ctvyn zBHP`H|B5-{3JEiAh0CfZ@kCD0r#FFL( z=!_v2RE%=S_+GUBrY>5o@3W@^m(>CebW~EQdS;f1fV^;@0mto8!CKEQG=aVXRh2f`&$f`CnimKX z#bSA}Zp8rxu{-)ZilRe|^j0kb2Q+HdER*;BMY2KJg^EPpZ#5fBHleF~Q86+iGb}1O z)17x1SY1V2rw4=kV68VVz7f#ZL#!N|ty@2{CxOvRR{81J6ao4d&Dc)Kb3Xb*Bei=L zwLE-v5Eg^9Xt9693T|@xGrjn^74#uI@ThTi(jy)Uzcoe0&1-7w_HVlMZ4=n04!CSD z8UGnIpsPLlY4Gp#!XP;C0Un}Y=L%H$q{#I=6p>tlb&lK)!7TlJ{n^rxn)1N4mWewdG zU8xDtoaVXoqMIhys5wa|%^hnkz{>_FkMF1WHIDseVT98gK7p*Pt5HUZpI;$PDVLBNitlzgDBu}`s%*iUExdTarY#``M3{r*&J1dA=O&6&& zA=6&p0c9`#yoUKZFnvzhg|!^=v=@X#G(=}Pq#jT|>a)Z=@2^FPlD+OdW1#K8)CfY# zut>^I>*iP94_u^ioLbFp^ny%ATM!!71ujW$AyR180IJIVI{cqB24Ml9WJP(}r1Rl@ z0sz`9<$&RI=DDrCnS-B~?w*^+&iPkgEQx{-!0{6HNYq@CQV#(m^fd&`maiYBGhNy8 z|GHC(D0;g4b{gvL?o)BFZ=IDo1TQw+@4(zkVe5a66TS^3+N1s}+F(oj|Hcjw1CRJw z4-t35FoKMySK9@3PIF0HQzd>oPo-_lQ8 zzwZ91wBfniPr;(3Kl85phQ30T4FR-y@UIqAmHb_+$7mVjn+Qd3i*1){xoS-H7ngoMyd7+y~^1;Gek-T(1^^sfEB zLhq?orQZs8`92hl4+H?9g{ogqb=1`A?AM!LE_>ql4s(4krZL{w20Oto1t${@eEahl z|0e=^UJ#_b-?wE73X3K$Yk8D!mfjp?2l9~eUx|i_!~IQwNJ+u9j*@Sx zp?ey1H7qS@4F4+c7DHw{E}~e3uRQ;#Yxw_Oj^MyinX+cru<@r4oe0c}s|BqFgg(E> zwl>i=-Uq0&$)eERtu1bIcV%s^t*p4vW&A>9bG}SG-H&8of@XKZ&CVFB*0CNJ>M`Ku~ z4J&)bY6a8!qW9c67=0IK$zuk!h$T`o5|$A6g4(V zR^Jx|*Mi7d_pq+y$s6OGWz-Lv`dWgC+fnTvE=u(;O#fy9=b#cs zduIsHIOXRz9$G^J&C39sE{R3g7hRyl<(I%U#Zz=L^P&^gjrI0NGfzPNd%YI%00Iw)R(l#V#ISm-TopcB+fA% zpDw7icyIL5&Rd1iel%+TG+Mtm5+Ka4gqQtTUn7lcv~lR-z_T|>$>DK*my29yH$ZsC z!rHO;$?5IZY7u@tvSNz10OWj~_f+$TZm;X^nWUxzMjO7}UkD^y*J}}@3&bu)s;v;# z(`nc+o7+Czp;I9j0a?7o+B>wdYi_JUj=9T|>Uv9xYv5yK0rZ-6& zJ1G6`okT7N{AD|C$AtrzGoo72A{Jynd#cGUB@cG;J&5Ps$V;jEjUb6UjIm?8{N|6&Hd1*A+ciAbQ}|1-^R0ObWP)D)!L# z=%fIJbETZvyFfxegb{@)Vp9QYCJkomcH6wF%^C5iJOL-)R+`H) ziM`HY(Cl1VKCk;=n~))6cfXy4EmxN6mn-8G3z~3sGZKb30Ximv z>;6_CT&>19*-2U*aH-GyB6zIOmZ7mN6?by-4jypa)J>=cbab3$=w}*E#0r$#Y+tNy z;||n_Sku%9EDfh*$esh;^ZgLV_lc997wqV004Iugbk_pEJDodB!exH18yFev$im6p z8=)LGClNCsg8o)RKbJ6e`UQ(=H*%$a76i`gMdfM0vZ3%k@Xkxs6^=Hx^&?KK=`xE1 z-0A2K*+^rE)#8RrU^&fbqm{ZA0?i$(t#qTr5`W)2afikO#Er_>4C5lHq=Jgf zL+L703!>?i8U1D(UB`@6gf;)WO)_y}ipwexvP`_!puDHf_{Ngt=k0|ZYk?eH-N^D)_sx7s zZ@qi^C)a*BI6HSq7<#*|qcQQ_JQs`?t~M=$srZ_up<-5b6~5&YBMtk!npr?VoQctw zZ7#~+dUgsJLtH-MSV4;b76a_Fp?5LLefdj44B&5c;Vw zc-AmL64Z4c{Q)c%yMq>7`k2XXRyIHn3?CJZHn#47+DC44*ftrK- zeFQ!?6M*Qg9B7 zuze1JddEQyKIIiWhRTycyyBI$;5;CCIekQrMs` zzxwHGvV)D|$jiylHIp4D(G?tjVotl4HSMTmsWc!#nTaoX5S~p@5|C8UmRS)PJs(li zOWd+;X2^4}62ZnzH+rdWXtp%Fpnn;p?ix!WvdD*(otVDm>mY4p&Z4uMqa@<$VD&1` zNtknm65`FTfDTcE+B90;T+C;KviA@9qgeCu^4J&{Mn&TP;7La2WM#FH;5gR1gu#mD zy!hcfnS{$?i9S=&RPDp_GniS*n2thAE&&u&OwEfvr*c+zRl2->~X&}$5l$mux zy+@&m0KYC#`>fLoI?vtBywT0TzU##%Ld!sHsb$eQqpr3CZQObB08O=Cp@oxf+H4~j z#PG$+9GoU?4M9jwZwaovLFJO3(1F8J=pw>4uUw&l7zo*rfPM4e#Os?zsxqwb29QqM z1V+*7JT|swQaYJ7Jr;|i?VYA^jKzu1%d^xgufEk+H+5?H14mR_%Zk|M&OyU2%w^r0 zg&0r$lSXY-t_m=K5n7+Og@SY!dwH(#Qt9U~s2=>iBVC_{&7)%UpwbhB+HSb#Z0$W3 zif4Y#Fs?y$-Cldm+G~`jpYyaM)6628g+eda*-+x`;at+1;w7H!eh_RAA2NRPSz3V;4qr)d{&zASoT0A-gR3iEuDG# zF0H&v3oYWh!$q8~AXk~LFC1Q+br_v8V|DvIIpZy^w7k&b*6vE0znqbhAs;CjY8WMJ zsq%5YauB*fs^xb_%b@ZdN!|&CeC%RP7wg0Q4|9LGA}f%}O#@X~{Hj|ug-xs2?Do#r10MZ5XiPSxd}b63N~}*;Ew2$p zm)-48$BOf*BK+Yt`i+mawkAWd#0>wX-e`CnA7z6mGjq1Ps7O{1P}!H`oWsLa8(-_y zH8HmWNSnGN7s%d*t@JUGxoaw87(=u(J=ZKzfMbKJ=v%kdpF&}bRi>a(x4qC@p1;v? z9ORiMj8Kvq0#q$#H&+6tlzn=QH+8{iuGZC=aHGIawBU8=7 z1~fv-%#UK-SkiK4R94KyIJV!NXAvYvJ>Qz$H2jvDiwjHM;PkZ0^(U=76Qi|!4Ob{u zN>jJ`1sUV|SvkX&Z1^6Mmwc8L%xx~z(@rti3f zLqt!Az+SRgbI$#dP}U-gijWAM%C@MAb2+P=d4Q>QP+@{DaV=l(|6%VfquOlSJ#X%| z6mM~t;#Q!zLyNlvE5TZv;O^ zYraiBk(DpWl_MAD`8)qIOAgYp*vL?)TF}X$XKSgE$#Y@pA6l3B{K`4h4b6XU z7|-CTBOtJ{yFU#vxrR_OaVPB+yLpc)P;_C^1`T5QW1rQR+;7I z64!QrO1p|{aEvjWe5L^bTRr!Y+pvXH_8mQPI7U>b^_@5%B65dILpY!Oq(M*Tcd=&@ zJzmWED+;0wWuMkMSM*aM4s-9{bMZNU_#jpvGOAfH)w&U*=(R})=JEcs=pWC^ggBt! zZ94JW4T?>h?NhsEVhXMF7FUtAfyv%H4czaFzNK%3wUh+!16L}USzNe{>yddF**X$~ zHCWuacs6O^pqb8XhfD=AR9`7!|9AUTa?KS(H^sq?#QvEo^@PjZKH9g0Iz-j`8NFv> zl}*5lNYvT3x95_@tF89iq>>Zr-^XT6uhL=?zM|lk_=)d|6gCz$6^@yNSf|qA&3OI< zT)ZVH>+KV9q8xP-B!QAVY#upfnP|LzxH+DOKk~gJcKR#FSh+9@KmVII6LSp*{f=oO zRODE!brC6i(lpVp?D2MTjCXT37-geI5skt}{)8o(d8%(h+J4)y2uiy7F8qeAn0P>kLe@vs+SH+Moqv`X}%mCs{A(?4Zp{&FU1nX93y<_kr!(1Ex^X^(*}oKc8>1 zQn#PgStcTa1ZCItS9R(dJNsM3#Y6>#U8G^Ni|`ri+AU+j1Zcr9(b(%YL=3)NeCyCp($ z8ZW*ePTT16`b7o1@e|@1<2ZYx4U;5X+M{=l>W-R+V@Y;Wyy6>@D|G7Xxx*eS3?vEAytQH!3T4rVCsu-kM)M@8=uGpq4rk}C#}xC}8uhU3cn4O2lZRyn!2)jk zMQL+NMSp$hoSGh{S(y91m`kbu$`+aDb)Y+%k97^7CQ66L2}^!ykLYsDGw^gbQZGGu zpI=VQT`sx!MatFk%}qiZco?ssyuVRt@51T}ofV+{2w@K%iBhUzU-z zC;E!=d;%oCHY?NeHRNcEEGVSr1XdH94BnsWx@m&J1HU(B#>nmLtdV0m5iFi9U4Ah- zmLYB~o#Ed#)Duh%roGJ5II6Ju;Y=9Bb1tNnl}&q4LCRw$;^(?e^PpGHV2F$6#E7~L z+P5sD!cfuBs8C9Z4>bP??*56?{O{8`AcDXAsq&XceQs&BU1uziQ~NhR z*N)rD@Rr+*9h*^g5Bk#;JAKJI{M%R+-2Y|)F8-g)zb|h(>@PMLD#~e6A5%mON~iz5 zW#pz2{eA8E8z_#p+Jb@v-S66dS;GWw=2tJpgB>Nb$Ne;GulK{Wq@-P!iKL}T`@c`@ zV;tL8mv{APArGYV0qfPrbEbJOF8@62@H@QDz~{$WL;U%=J!&p4-;^`CtCpE?jWAXmScB7A=kUn{twzmAUMIJi*`EnueN5sH6AcAdZL`@^^ z^0qh`?Aso;cYMa%7%2I9&+)}uUKFMKsQ{kSl34^zk$X@wbgKfj&1A#PF0zN~&C zpR-Bb5kXjnD}Hu8j-@-*)wNZo1+=Kn=F-o7Q7wIp<9K7^QkgRXYV;{70mx-FH$=*u zV27)iaJXg8dK>W#swzq-nj&k!>DLX#J(b0m_JKOe!x@48i_fh$yOPWBqf`btEA*^Y z_ta2zak04J{94bVYxXlLv)u@n9*bzUg1q_ig#=G#wVgA9p(hhc!6(mZ*C9gMz%3WS z1um9bjK6OCCly;LDDX0RMxlVz`l+=l( zLz%NhP=0dh-US-{QeA^H&YF6aFjFz%`hL@@6K8RD!cG_jo*UcB+L8`bD&;&_is%0P z4uYQ=^P`u4Glq#^>E<+W0rz1u|2QOR{`NGG`>F8nyHN~_EpN#NmJEeg*lIA&y+Rf9W&FDz(-jNwdaj<%P^yc?Vu>JVfhYKD|!+* zxVF1qPjQv`>!!z5j-X7_pI%8F_og({0MIF_g8`_B-Vl_1(-ZzENFhEI7*-TI#D_u6Fp9!Y3%b zsQ~ZA2(^PQ!9fGhj&^6A^Zekb(>Q((Xv-fb#UkVleqo1RsRkYqW1Ww4Jnj{7OMbh6 zu%y(RkG?*t5gC|N`;A#m$us^J()-zYSiEx|6!s8-M$j+c3#Rsi+NoZ?;yUVSYIpza z?+l-QtL)(O&^4F5s3f;n-uOn<^h(I=!FMjcKJP()>7cUOHrn#_nD85s9+f!)GNE`% z=Hkc%)9Ai-JYdtfeg&T1-mXJ=6}tgeZ6?NZ3?8)-w|cmJJqKDN-QV+H)Li!ac);qB z=Gl?c!rqYap%k%_zQY2n5YF#;c%{Vn#(yBjeAL+Q5*$~t4?0dWVK0A zDlELo`mM857ttc99f>!}WIw37rxNB@TqhHDGsrk8mWe(yG*z0?W2mkqH`gKQnFcQA za}%Z1b`)}Sa`+arULHBJTvLT8eY-d7ks>f-dEjC=Fwh|B4I6N6ibWSm?`~>_>e%c` zUV8~pt~F2ykdVex+Pu4E9T6n)LG;IBLnRJe)Hs&*m)H1+ss}e{HFUMM#Ns2Fif^BU zC_B0~c^OWVa&jYMs>g6YZ=fG71}EYmeON5kJ{5F;Dvw%9zDi7p4;T;w^N0f1u&Sz; z%XH|u58)CymYwLqLx5-#YtJ06YY>j&6czE!N0~<7d^5dw<$CK54k^m9pq3t6uOr>h ziV3+{{fUqz2l;UqTZF^(bRDc%7Ota=uBTFDzLxbK2!;scR2&CB`?I0*OSHZW8rZ8J z-=N7S*K)Fu`o{uK(-0}_~BfNJ3=W%n5S_%Va`)0;J(%? zttmaFza|<4l3-TEhydE)`g2jjns|F>&$VqtJ?UFSG+3BfV0+K6yOQk3QVvHH zDoU7xVUR5+dxkeI`=?mo`as1;uZzp`&ek+cwQ~g2dYJhZu6 z)S=YfCA52@*9b9qXE?$f5!;WZIyOvFKHIIeUhc@m#PXcGIModZzjLeyfhbj(7iLzL zatm@6ygZsk7vuVBEWW8yiTQ7y#(@qJ8Y&wu4@5la=RL2Ce5Mxy!1fKaR-pNnA{>)l zQA+iL!{d<#h3nbdXbFa8ff6%mLbY;;*up_$l(ojNF>F!Uw(-!>JtgEf-SrPKMRyyc z&pxf*X-n@RPh4QA|E%)SW57lb;ZA~$X1GeiWfrG6gtJu3t?UWYz>)@#B!r0xOn!R` zuJ8crCKHTC*nM4_O-?S$7J|srWE)GVa~+5t=cEwHefViJ=M0_Fh=~L-wn%t%WODLU z^B?-nyums2P^+j0kdT_lm+3RVSyRmfqpHJy$V72$rlo$dPKi(?VU+DPL!L##>YC<@ zAY&PXDd6%aifLWlc{4mi(IoLNS89ioXwvxR8`ndL>2{?igd<+gs=K*DdOmXFM9IW> zz!faY#}qhh0o)6AuStLnHO3)N^}i%fJ`c$>CA2OGu@mAQ9I--(sjz$G9NnTyUKHM& z%BiF-CGe+`OWgxcx~L15kc%_L{4+*%K@F?tpWq_a zcpSOp%_2eQCm&jQR!hg!Oh_Ym1X(c|-w<8=rABnM%IIYlD2~me!CB>Z ze{u6?GS=Z^D2a-()`$~jGjVJRe|{Q>GagCz!sMwo&`z+Z_=Oqf8i>+;t+l_&-X7dD zSUlsX_fMPRcTDyvP(&B=d2h17U=ayv?9erAODV2uro_>G>2Xs-k56b${EY}Vs4lIi z#r;ojCJRxHF4xv;02Be}xeiRMxC`+y@>t}1WX7%y;3lZEH(P$!DoX-D_1HJ-Eqrg;r9u*M=GG}f$n=i4 zRo#_u(b?HqS>t8E^k>>^U-5;h@T>=k^ifVlnaElWF8Oj9p-+8+k9p-W#bVcK<#~owkn2)iaI8R1@TYJlRyF}}d3xt7<+O?Zw6vVpFUFf3&(^tea5T_D!aG6J8nHkK zJI%3%B_jKLeoc+|=8|&e>*k245hA`s4JSngq7Uth<|Oekf|f_9_;?Q|a=SPXQmCdE z$wY+j=^oQColzg#y-qi1I5qO2nX#3WnaC*jL})atdVHjLdJ~vtEMpYS5zWi?h78U43-m2 z!{SHwRseq|SX4e-mb8!rX}4~n6%Ip?Ioa6(DgrRI?COc7I-=7wauRVwe)dPT08~DI ziz(Ix0uyM=DOr`+`-hnDU)WqzGRX(zD;Ih~>WiNzb}`Es3jx&4ZuY3i2J6I9$CnQq zC=W-VZKwF0(0Z|$aB4MWY~<#UqMMzXj;V?qDh0KVw&h^CCo8;o1Z&4zcSPM<;xI~1CeNS5yAd`kfgyXug5-;GPjOx zsFG~1@&W_f!-R=DfPL*}H-FJ2bLa9GiRum=(zElm%PgADTBUtdFmbC$ET*mz&}XLs zm{-Y)o-;&8$9>SOx61b1Sv3Oqxt)uNKa?R}$x+IWu;~#C>qLox@{r z(Eq3-w%aTqtjZ0lkm?d(pbI*?I5!|`H3b`oR3*>mp<3+%MJ<5z?|EvC78L{XE$s z;xr34G*6hg@zeZIJQB9y!^0-SFFHFo13VrkUMDE$AeU>AA(H;r{Y##UmJOQf+3`J_ zpF&iXj4dPMd*$f~G%Ty${186z{ocJ*-teBIW{aBu>e`w-DtchMeBlyhBGq!{ zz`!im)63YT^3g-Ou4E$wCf=}dnDQbq{JqoB7QuVb#^i0sBX#d)uK9W?O}Q9~J@NCq zY751uoc6ldGW3aIu!SOk`<4Du{ZoxfzerBbClgLf=G-PeQp3+!nh#}`;XBI>84bfY z>AW%UP1x78D)RKyr0G^)dnjr-oz=Sb`3*mRX7MBoOmEpL?NZ-A0{?}a({~~@mFG{? z?CR~shc%zq*o2bg)iC||TFOi5GWP2uV(m>?CI9nn@Do$Biq@cDSS>K&ND5ops-!<8t_Vzw_RI^k_T-F(Y2KiyWs;@_VqBJNwq8ZM2z zP1afR^4^g=Sy1c`vhA(wpHY`eOW4Ync z@fITJukpk9Cz)scV98-c6Odm#-I8H|p_aPHx`gOl22Au(;Rm27paZz>=S0fFyYU#M zx&;xm2k9oiWh zDW=@w2NM*galM`x^L1XUnd=a>vEwGh{z}!%w(?qdOVWcW9S)pyKouLtTU8;t3agqW z+}EmAV+QThMU+AzFUz z5(v4B`hs#`z}l5eE=OMUl@7@AHvdd&Fh9xM-H)Ek)nfdGYDQthN=tS_0-*=H`vM%Z zXBN`j+xNMIb^e+#&+?tIXE@EPWF!B@@KDL=Km9}J*OzMzGI57olysW)+T@j|_@#8Z zybF5ac3!OM<`#|z{(>C&1OxCWyRl!R*r_$l>*|)#5McAJGp9QqEM@PpZ;K&vGx!GX}EXSoh z4BA-$wsS^$G~b}fONrCAMCt3cd*O+cndxmReSP>rr++SqaIK@$DC(D-jyPL=N>gue zq@t_0fPoZpa^Q-N?Sa!d)oR(l_+ANW`!f#X(A#Zj4&%B`XhIh!K@-M8y{!}8o7t<= z%Gl%$$-?tM$@HA;WB=0ZgQMf-q+lP-%%1!CJ(mw1iZ${9FDusNP*_Z?A<}QtYzlR3 zl`y>NGurNJqra%wR(BV253FdmeRZDvQ|TlkrZm9a$0>i<)o*r^8?P+`CV6;nSK$2& zL%h=y2;waV&2+xFK0U+Xcag?NbE3zzS(Q{+FW~J5f%OUKD^H_T$Y8D?l&4FzjI(=gTORg79tVi( z9K-v2F#*0dp{dMjGrpCx0tL;cOSv9CkjTrMSZrLQ1R|APMTIC21li9ilKA7|BT|zx z0jeeupDEb7@VIs?9+OsWvOYSaUHwSWht|yWjEE>wbupn%@vZU!lw9xA<2b^x`&Xz<`t zB3v2zC$K7cao@xGi^&2+b$e&P-un~g^!nkgMG!Zut8I))0DMQrV=mE>=={TUhg!L= z5imPXWYNEQ>ey+e!LUT7_ema+4XfKzi0xOm{oLpAPr!^8@TgJEi*UrTlM_T}GbsFQ zS1T#mg=!g|dk`#%wD=z0P+eHaGUeab%eK4!pYj*k$H4reG%mA#P7Pa6;#e~RPS5<# z+Z8cgN~)9Ni91tiLBU4EHX!?Wd1kN6#6I_>*yLKF^a%~83#*=;lOO1(O<M&RTOH#q2C07sx{ZsTxGMU>M?;+qec}2>`%YF36U+h#GKu7Xieg{1 z;l>`SDlXeHl=6tBK?8ov#v8PL^{a1SH*0|t^qP`^0_PGBH=%kWma9}DrYygZY_mEV z@Of~n6eU=CMu+8l9~oe9&aVqJp&35EF#hQ+Bz)>t{)7t0d8qu_+8h2ZV#lAod5uoW zAP4Au^n*_p6|mx7E^|UzP&ZKR7i{#tuudPsk_jEJvF>Y})vokg85stK)B0Odb-;ct z?4;ySWgn5IJ{){~*xX}W`n3h?-d7(R%&Icgkt>BztIx@IkhBac`ro-Q>ZB)(6yIgL z-73EM7lYb-;+r$#{WX~hZti<=Sg>e!zSo}g0XctaZmoMu@35--tb>trBYTg=U56^@ylN8+wU!o_cd zgzFF0k<_MVli_8v0-E|8VP;Ha(5d3iyiW+-s#Lmt4o^b@}TT{}-Oqh#-L_B#ce z`{kbDd>tL-|F6iWKMasTb8kF9Hpducqif_{=UERnlRj3LGmLn;lV~Rq$fc4hX2Q

U?q9Vf zX#wGlolqQq)03RoVqG7NC&%9$9S#I)1AAYhCpAMId)s=5HNx|Msx1h8ekU4;PM0LG zO^GK=VSUDH;q1>yLGA~2ey%4Xw#3C<=^fn) z4?;!uOOC_kWyiG6x&>6?mCLddgENh%6C9k4!ocK{sh3ar-2rwHq*#!QfvLK7WwMqr zcY$og+)}P%{9*M)@&l>F<6ZIxfXVcnX}hEVBV8WJ|EdpaE0Fl{3n=DwsT3@8FuO2O zlPT%u1KLxZjR~dt%<1g3@NrAQRNBK(0CwHtX^Cl)S}-+%I2Mu{r4^%F!)dqokqz_@ zd32nU%F;Cw6Zi6{>1`>&20Qoo-*|MJHx^TWIowyZfxT3(Er>-B>_HR^+XnSKmrOo1 zE>6vkTdBui(n*nRCjpIOSs_a`jl;^%?}BGL_o;_-9l6%emdE8*37wZfx@IY4YK}Gf z-}mz0W4DJ@Rx8|?H0+^-t3b{&t)yPNh4&V#ojZgPUNQD3y8M|P6OkD_QEagM*MH#x3gNG6l{NPyXn0!66U)DsSY_n2Bf#-887R{osz(%#=N-e2z%K4tv)`>uy)c4XkmQ4*E0 zUNsyVD844Xco1LN81))@G9L{vek(th8*NCUI8{u^i0ykil+kWie)owW}*Mj%A~#%@I(djp^rGnQic(p${se|ba;+du-XI2Fsj(ka+lpO zNa^1Vw|O=6d6%-!4MuJGG|-Jt*1itQ&?Q(F$DVkkQhS!adk`l^=gPt%7k*Ha{h!0gkEskpT3J}t_)`f&hBRqj!c?;8$Dw< z>~>Jb*`Tj>&dQG|3`0+J4DM!sH5hX+ql{IQ^(9S7br{m}VKwCsZ#qu(+45M@7 zlApMFO3aq2us+Er%Qh|aVlzAG7DXhFJ&SvRF@Cd^&<{%th(|`i% zRkE{UiW>VSd05RYeuZyyKX|9G5K0Nf15(KpUaOD5?~TFHIB}O%$Kl=l>3sdh*E)9p zW>Thc>g8#c?55<_-N_nY4!xqe2U{g2w@?{I#o5g`??~HD3eM!pvI!=Z4j(MMc>r|e z;mxrRFbS8fmd0XzJ$7S9Mn}y(F#VW8QQx2-E8lbA<4lJ1&TCn=`iuzd$@F--I_$>U zmbc=T>@M+1=8Ar@&F&NZg2<$;10y9={B^`z8~A;-<56^C0xq{l9oOsh23=^a*8sfQ zckh!*M9N^ptGuXarSw*R0x(M^WZ6z=*KJ0@#f}d)6SHT@@NEptltailLLLP*ZI~)sAu#cS20qcTt9V3jet@LSY7(dPsQ2V6+SPpaTzSlH)N|m<==(^k0dE_q$V5P~`g2bHaYO1qQ-n4uk0worNWL#P2dvTVl*K9tZ4>0)@jPs>6kuBVrB|}>tt_d zG+3IQjHxN~5iiP4>Fv%Bij#@`vEG%)FSg$|5?i_o$qHFrmt*41Qt9TthBusd$jKPF z06?m6n5m%W`g^l*b@m~ym%`gKz;~sdO*I*k$+!l4S}gSy7rGox)zR36C^Z;K8E%k% z{&Xqv%xp||mu@?TV`uey2~XN8nKdEp?7s(sk{u=O!YR|^)PKDx_8*vzmlU}vR4)u< zw2#l_BmOrF$ZL4-qkhJK)pS5)a{)$1r){3*Xv1!-r^=IE3^jb3u!Z{_%jS&fby1mN zWU0NYGr+=hejC=XGQR`s&kZVr>gd>kOb!ku9hH)QPlJbj==!IFzxF1ufyZ~+1}!L! zkqkXu=H39dU=T-YS3WBjRsj?96H|>wcy;W^G3-X9g z;a)pk^fTX)k%a!CnodOvai`J@D{!bSES4~MREj9JPMXtBHBp(&04+NEDE}`1suFHE z;UH*fZN7(_)Au`9qia(W#B8Fi&4P4eCQ@U_B9(VNN<0}FQes2tud7BpJqW-g=>p6= zL%MQSOHRXHp9%J{ThjW5jI%Xz4)vQ2)Rmp<4KUZ<9{Z%_VTEH}cuB;|y)r^3&kk-7 z#1}$a7#d&vt&3XaS^#LD2xxDB>I!z5jl;EaD5)A9TIP%l**&dmHIjka*uNY@YO54r z*YO+J4erILn?{uW>KiG~>(g$Jz=aV7U~|4?(JSijoSU4QMZ}p(MW-VymC?!n$!5yf z2T!*R?-!sl%bSx;W)krN`u-ioqSN0QId07tm3JUVcE>X3D(zm>m<-$& zxl(8r>TR+9i0O%E{72+wx)j7&QEg;x-I_Vc5>?0n+bC191IDLJhLBsi_S1a%4@R`+ zfSJzsqj+ z`MsFXQ|V7##6gpz{Db2*%p@PW>_55`c~~6{54b)h=2YI5ajsf*n*Y<53tX%h7NF*lm&mF>J5P>& zG*MDm7yS8QzSDM1THP4@)L)4n6MV3utJA+pVOER9qN` zVqIQo)<%@1W8d`T9?>Kki3mmf8Lq*3C$BdAY~nhK)@~+t4kBofXWQP>lTAT>S|{8n zdHkwNfJoWpR*W0=zLmi)9{Gu>xotx&-tT8Wv!0i%*&u+0)9yPRndCFevAb_Qav%L= z#ix5v>s(Kc|A{<>m=VkEWdwQ~^!g=!`?$(>!Tok@B#^tTYR22%87&8X7Cz@+v3jJv z%%6q=E6b3U8=%=~vHz*F2cS2R&e^UR=PxZxT@+$6R0)Fvd(r*#owrS7%v+tWU%5Pu zo*2HeX7KR3+a86sMx;LZfc3Zi5MZ#>?pzX)b9j^!UQXeo$;d%@;yasAw0A|i-X#~@lTU#Bn6W9Z#U%;D)W~ZBecA(aoV|zH-qy= z?&r?lmHf7Dae}1NxlEf|mE-5Xx6Z zlnM_FvzVhgfc!5AB@I!%!`t{SWGGR3-MTm7@g_h9)(vl52K7CHHs??q!-3x)H2%Yd zRLuGU8Hcmo13#wx9I4dvB=G5N437~sy%TB5T@PDmbVQU*RDas(nv02;*8ZDqSQlpW z{f^s+!2D)U9 zIkI>uOicjOWxkx{isab8Ef|_;YW!ORgu+$&EzKVLvuiQPb7!=_(0)4pg}TOA==2H! zPoD-#81C76pV(R?w$fxb3vhV?QF4OlUW}l^>7P-f%q}k&iOa^`j()(kv)|8|&pxc) zSk4M1GO<^Zu_&{=zk|VaJlq!&xP_7PZU>kvvM|3uIcKrMSY8f4insjmx2H&VZP%l*scD&h<%}-&=%rz2lwW|z zbM1_VKyJs~!{ko>a;W%x%lt$Y9g^jAb4o01_Wmw;jGDG*>Om`&+arI+RsdQH6R#y| zui=y8rZTm2X!Wm(keu31c{;TkQamoRxNy`-t!gxI$^k!t4|^xf%=gc3yU<95o6eK^YKz< zXQ?vVgfc$OuN$e*%U64iPhtmAjz{X&cNeHeKH*h9Hlw;wN1r1e)$msg;2p39R8=!p zi8B3jjPI3zb#2lV7dL14`c)kQ3Pia767FW&v3~NjE!@i;d|fWe)X50f;dk%P8qZIT zo`0{Sk&$hWyI0nhysAc66@grgYv}>Dxk=Q6TVz@f_i*^!`|U=@l+?m@(rK7zsLmpG zHqlCjrpZx899GS*c&4o)F>ywmm3Nf&BCUX(x>5$lJe)Kth_Z5;J`k_0Y#E21rC-BDbC`p2{51DwKj_j=w$u@1T;N7OYRT<$N&7#X7Qb#$UJ4^d(Ht>l5<)5 z?;U@(h<+tawbskfD3Ler-}EOt++uqV2@16cQK@GyZl%QF|91ZMt$|a-l2S2NU~pUW zFCr14m^g43fS7(7#AW5Mf>gR+*Qup$_M0g9=_=zyXqTW)1O|~DTTbl{y_BwTbp3Am zw(NbiL^*(juvn*=Be%=Ff+;aNMJbK1-y?|Ju?%Q)6oA^O0>!>}48jXM8U$KZ3c&)1 z+=FM zl@J6ywjH~fN*Ysy3iuT!VUyH`(bM_+g za2Q-RbO?6wtD1HI7;tcpdL(y|?&hba|<_-j&wpN$}XN6*;}3j8ZZqKKUDR zszH3r7YSiu_PwqLP@NJ~J8d!C6ghe1bnNGS@Al2!`6Lmxun^QRvvj|>eBIy=yPwNE zZh$#ntlJBDnw!tO5DNM9i=0Z!Cp}sFGBi9~p)ivG85hp`0c+!#c%cg|6qPUtX?lx+r27Gx3l;;@N9exA%M zFv1QP*S+C>a`kxO;v#Ef&m8dupW-O+o@S-|vY4%au{)cqB2+0$RlCnli6c*m#iF1* zX?x|nKy6Es-siLTd^8)Wab-%-R{#TQC^eq)5Q}`xxKV`VU~cqego`j)!Cb++b_ukf z7@>)pNf_v|DHp##ydl+usFZUp4i}|mUpyo18HkK6Ku`3RnsipsNh81T55x)apo8)|3r>!4oWJu;`zMg?3BMgmnSzG9&o}x6f+|(2<+jsdGw0{9DWo zExE;qD(S#N<@S-rQeBs+)VgUzhSdz1t*EwE^`xfH)U-fvtXBmDE%$Ad&cM`op0bUd zBcN734@5w_(52M*~2U8J5P!UXYts^Y9La&}sJbJt~rTkHf zkQz3BVis6mu-Y7;q0=6`GX98Kc;2(x{+Z2QWVneOF|KrUrG5z2kbf2=b$ER6GF->^ zU_|=vxH=)71#`E%)Q20rF@;5$!l{;%0Z_h4pTScnI-d zpB7A7eX6Tn$^Pm?m&HT-p_~SU=cP;O>}omJ$KSB-BoCpX9n(e%{`J9~O&5`yc+yz9 z`w8T*EIB59Csjj%npjknJX#JT4OQ^Y&IT&&L5dppp90T5%nl0FE#*_(zl;I@&C^X1 z%x7^5jDMkhQr9y!K1AMQy`{ypNt)T+?Yll&K;?lrlxJsWkB@(Rl7!Jgv3WJXDIIv; z&-%{`ngJPBL}UME0qd)SJb%K`Hc{!vzMdYf6rbhWuj{J_(9mX?%>LZXg#Bvfw^?RD z^L@iXqKbCjDB%V#_PG?xB1AN7BK zA^zX1|C=fK|9x?Y;}S+tDJW=YNl{M{7G(bZ>n-h@iof$_UNNH1*ijF@P}B_n-+daV z(oKk##MAR*qxL8rhyVCiH&67v`{eS|Z_6`N-^oa6gD#^*4=+y{noo4MuVtZD`4k4P z)uno72QtE29AnPrOt%KB)a%Ntq95EZ?Yj) z$l16VAAQ)~kwPByN}bgeR>;Y(nywBB!s=_KrEgQ)_p>jXda9ZVy)~>kE{HTGr=5N$ z<;dkjK=Bm9A35!>Ld)l|nh0yex-z)?A4YYwyQ6cp0&j{ZkZ;~|eg_|Q5KVN4g zL>WI#4Y}#P!$E&I*CzbrFXLDq+|oVr68SJo5>1v}KJ=P$0iHibT&|;?X_oYYhhX#u z|F0Wcu$>5w3K3mc)t{KLt9<;wk~07KQiNz86JUSluutr56dxdMDK&_46My@|Ek71i zejD=YWrUo?aL9)KjB4&ia@}Ri-Q&IeVlHbhBc+bI(PX7cArMz1?_{4Qp#q3sSbOAo zSULwRAnTmm2(yV?O!lw_>lLt;agCR!^E!KLp17nfE&F|^AG06oS*$Hmqt=UbDLz*5p0f|Ky*Kx z{9(Ry#!bzmp#8qpf2)+i-q~(}^AavW{$WVnOyt9b2i$ic_xs76&USSwS>;7bO+!Xc zONtDy#KOV?|J!@2qVaF=9<49qcJ&4K!>Td8bd%oSj$E1F!#2*s6jt^s-!=Zw9qq}! z9u>~0z-?O_=a;6&wB^%VQw7BXdxCF`h0E+9EBciNM1(oVZ7!Y%8{g{4tgSWG%mOwx zJ@XbN=V`7Uk|nou>>tl4yq7{0;#rFzKb-Y&CP$Vh!)T=@NjYeS9j8epV>DiRexp5u z0_XOH{r3-D29{@!e>igy?^st_LrfgYLGDv}hIN!JdHo}qUt26VXYPA2=NgK&nGLvv zXfCU_^yY^i3jRD$*h?hDFY#^;HP;#W7+2}bzy;YHRX1Zd{{8arbo1xj|Pk984Y8H6Ke2=3vI;-_ldk1wL7Y3Lg zIs;AS6uMmy@Zoq^<9^ncKPqN3@_WBX9QC+xJ-l8l1$ZAEGG;~Q>$9{jan8S?Q#$|) zQRnQAR%(2F?OtIkWMh^S8%+h8mU1tCq3KsK>Qof5Ir~?0OT$yaN_WgG|}_7 z$8+_1Eafk+6>g{(>Da+oxKcP7S0tFSoUK2#~=4-urxS)oQ9lZ1kZoR{&8* zTiH15Vd4#w@wcx~u!-)G8*$)KZt@S~B$a!~pMVH_esY_j(cZAFrE~Buen-HGY;5Qn^?EVB+HE^raRGk8%EdqY)`MLI z-C%BZz8IN%Ol_?Fa_{@aVPdq0TtL>gL_v*UedAIEy++lR_-NiaCWF2BRGXlf$2HGV zzDOZ|P3X$fbd|mC^*6}_)s&YixT0nU_0)~cn$}_U1I8tY%pADQNPCdJ(d2Ry>PZUT~5?X#P86QPi$b)<~=slek z_9%V)6)$$55FYw+xDr?uTDyWMeXvxgiPWg0ydUvW$Aqkeb^N$L%UDw084VUXCMAcP z5}2KRt*qGFqXF5>9I&F>@dpkNJf6L+19^VjefSDJ+Y?V0Z397@vlo44*j4>?T=tBf zS^Pj9&jC;=Bvg+eqm6fp@Zp6GLOeX^aQefkebs2sm7rq+9By412%(mvU_l5xZRg1 z%2_Qh07|kB??N~S(#2kg&%XMr3F$IIvB-$EvfA&?7}QYkICe%R?S9zQ$&t&RvTd@l zLG)MN&eKj=jl_9#YZ7x0FPSlY;QL5gYc3&^siOqKM}3&6Sb*yg(I#W%8HA`yx6I5l zl$a)t{LA?>^pF?dJx06YtaHUKL{8|azJPmwTfV{9*i!?NtOatn&+8W&C`D<*q>itj z83ffpa0N;EBz>;n_;em-@Li4fM=TnC43ayPImL=F0clAg)z=M#=?rFNfKcxbuiqvr z$3(OC?e66Ot3w6ou)FF>8C8kCcJS}1?y39LSL$Y-qCYEWOou#OdfcFGd293Mt*#mK z^ixUvh?3k&quhkJhGN&?oaI1}9v|$fl!$M4j^y{)%U$qv`EE+LWf$G;YRKV>uHDN% zOsMjo3U{^&R6diORr$hznlTOai__#!kQoZZ!t2F(1Fm*Mg#O1E*mKxYK1zE@o4t-F z#Hk9XyNRfX%#h-`k!>_NNJ2T(O&v_*#!U^#caJ?=Zi>E;hC)b3fJZ$yQy;2W39-~o zs4v;}5C%)8Utm1$%Pfs5Dww#q&AS68IvcbyVa1^t4aHg@u4Bv-@5IaJx?7}y+th+( z(1Z*770_~^W!cA~$4b}4dE+uYOZ^=TceV>!Yu?ULRgF{4-$Jl5cFtW39hX;=Uu8Yjm`ayS2C89o47>a9 z{dvEqOuvd-mUF1!DPvGb#!?w+K*zpEpzESYG?#hdAvZJvDxzlZiLmt2;AJn0R_=Tg z^A%iBMG|2vR;!=N%0Hw3v8Lj@B1&Jab;zn!CP3kX;jV$M;}2o7IAf_@chl zraH;d{}FR070=C>h{^t_TahuHNheb6@0<4_T>qpzFLBF&eRt>(F(J!?;F8|*?!lz0sQ^m{r|+VUP2DV7xTNe*cYdyh{0>?@64$*vX;Ur)%%MHo78gzvjyZJzQpY z43!J(Z%H$q#Zt=r8bXTcMx6gBRv z&2bJwiiBh4(5Zpj!~KappA;qM-`Cbeb6SvMdzRZx5It3Cym)?R_6xC4J6p3wP2tHkWifQ9AI-d7*=F}zK z6PBPyRiQa$xAeH9>EGEp@cZ&t`62b1p|F`1r!cRFn)@QBi39mgL~~X?YKf%i#*@ai zvQerguIb$rs9ilf9;5`V zn{!nW8I)B_H&$UPyX#;+0^oh_hS9&Prn}_OSTYg9xt7E>r8_UmEk>f2AMnwnwW|H($y2m_B*EbR({s?y2?9oO)*ADLdb(puh9k#hl!PmyZ=Vs-rGj!?$o$^ z4uit^B(=wbjQwE8k8+gcQ+|F98E)y3RusJNN(l1>Bbr;Q`KrjZhi5jOYPW?b+39y`S{8&AJo$Av)y4fyxHjR(V zMQL@zmebe!!<3>9NpYCY56Vm(lqi&uUO zGBWBIBbV8pCvSg78PnFo9iu|LN1xA7qo>lB7}V)4?3Qv$Vop0-SsRB8Df44XK6df& z@8Vkd)973MJknfl*7d~<`u4ric{=>*n&lMPN0lQ5Ug83FZCqH1MWY@LD!ch#Jp#qK zUQZuScV3ftM!ef`7+I#}J=~M_6a_Rlf`7RnqcGA@8j%E^0{pzsEON;S3rxQARw)$! zqqXx4YN`wKI3OU12uc$X6nFs%hA0G(uJn$AAkuq?AVr8sSBg@FP^9-}M2aAU7K#)> zdgvV_^b$xQ^kl=kyWe+r_S3!h%$+&+&OGPL|NPE#{?CsSW^~?NX5(Tjh;Xp?yDuYK z-zptyBwk-NzLXyHHqckD#YlRi5)0=s*8S=DTrJ_rEtX;PMEV38|(-)U;3XH__8WSrXma%%RCpN*u+3Y&A^EJj5^ z@YOz=hWhxQUxs?EmEOq`ejxhle*5LIQ@R0U?7f(2!syGG41}w`1@xEH^}ekeue1~L zr#d}qHacl7yn+MO>rs>6r@V1B8*Gw;O5|i5u^VjCQ6CaSohyc2-GqyltPmcLv8tQ8)D>z|@H&SFs-b)QU@^W3YeDGzB5j1(Mk9^3>C>85_ z#AY2b=t+C10q{hO|F9_a(h#_{FXJcMARqko<|f0oqW}KQJ24-jphS0k+e2VjWsO=w z@p$^VI|u(#aYK7e5y5Kyg@)~rbr-BjsN%0&piKPVso5!_QVes98sE^@TB6e>?#cZk zZ?`By-&`QmgI0+N@xd9~Sp+IIs>8QmBj54c6+uYMez3m<^=6L&@hSfJ_+SBC{j%8z8J03V_{AnEgvpM!00^8g> z2O>Nzl;I6^AeJ^`8PjZ}J*`fD+3@Pj{%HT6d)u6qj|cX0vuVO#R02!GH95aLNk5=v z*~|Ey)-v&fzHRkG))JN>_jkUvt1kE4Vrj5D=a8`c0Md^TQ$ZfaQ^&HbEd84zrq}L> zX(3dvTCQ(+39WZ6Mjm9nU2%Ob65hC~m9sMeU*)m#tag+E56)_*rCS}%l$J=iHH90$ z3sSck&dnd-wzI7&Yc&jM3Jn%Pp&oFF;IBxh-`>;J-P=A5+V&))M$a*aujM7$E-t>r zc1mDGA5DOA04l37U36Z7PYqR;gIEr$|5Xb%k>1J;Nio1~ZK+glO_YNjf7_G~0&Lx! zB}=|!Hyf4D1`f8W|$y%#^_g1%?fe8^$$ zzQ*f(RYG5CI;s$yl)}ApD<=T?aT(aqC<4<@fC&V670XTdu63X`zIwaJ+;dVvSXtP8 z`&w0(nV`TUr4iysiA2A@9HLZj^QjMpn|bH1e5VM#O@E8ZLMW3r!;Y$1rN9h&8(FVs znPMsr4#M-W+_COGYt0qgc6PR=?QiC8aiDaMwJ~Agp#vBOaBgy?GcGxcQq0iM6pODF z%$bA@85`d`JWNf7jj3LA-~8Zi zdTYRYn+ppQ3eMIFLGtDQh@XfTFzNk_@XZ)4i}rgANm_cj஧Z`RwkK{1?VQMzI_It`4SVl$ zG$S7}J0G*hBLh?kNSAGjxPWH{V(IDWr^Lf%^@Tv6y$(00YSsDU{yP}|FVEQ7Icpr$ z#SgiOmV3$#^j$hFvJ(d@&4Q`;0d}PXTY#D**{Ft+VmBv0KXt!BCVn!2fWn@WO?iqe zoTRfyS<@=JdyNk?{}J~QdwJVyGp_d-a%)UOl8MZhTS9h@_67!rbf^xwO9@NA^)ddD zHsDG6bX4YhbD$eHO;u|0i@yqF$j4NlmS$S)nb;B_B_`Hrr*6?-%o{9a%ApYm-oR(9Kn zN1gIG11EdanOYou_j-Eo1bT{t6hj+=&7kDWgHL%QSRV|0+nkX6v*LmGtb|8jk5Kn{ z>lay`N#SU(N2{(@`FUUWA1gyKQ-yPN?X>KLgGrJ<&6G2f1y|6R-eB-F@TjO{#W}<{A6!QpuSF=<-ak9aZ zfjtv2bD^!N?!k70uVUiht+y!$-}xFJpE^EQ9Xr{G6uVTS$3QtSQb<4G4>-L+lMk9T zvk9ox&@e{slGMsDK~@c~fPDaYG=tKUNDN?C!|Y8!h=Zn!|i?o6*k@#Z=8kjdMc7n`Fh zK^1*^8h-*xi+j?$3R< zs&Xlqo1>d_epw9DIO=fVMq*P=xDA5^`;#u)@(oKMmRYSxwohU#(z49%1`#g(eFH*a zUS!)$r4`bjoX$6Ei4r1>-Xf->Pw?}}w3_pEI>Zy9l7@D6XcR9KXBR}V@aQyoobYAY zJh{8;tko?6OJwtLGZ=xg&7V8Aj@&;c92SfR;#CDR1%r+t-a9Z6G~h;ehl(w{>xM6R zoLb}Wd674|eb*rN#ljB#t^e=Dg1%ahb9J zas99R1fkobjy4-JvK;!d%I47X4;!}YkLC=jttfWksWk~+?cl;|jn%MJ{AkQ$h^q+Vc8n3Bfz zVdIDBamx@oUB@L+IAP+Mmq`NgyRIYW53;4f%hogJ=I7e02C<$U&Kq^rG+bLGdzmYM3+ISkdqUY~TM4h#-zHW>)X^i5+RzFU zSa1|U^7x3ld7)X-gCBuZ=yi;hTmKsLs;i+zh~2SBu!u#KZH$lR*~Xf-0g-YwMw<5_ zHgoN8*Ck@KK=2l-qw|WPo!v0Q&xD=MmQbngq(qN9E=NKV*i26RC;kZ5I|R$zD70Cx zG|}aN`wvL8_o~h@KLV_Zi6vMJWxJ6+g9A?T_CeckzX63vt8U%00erf0Ae1P24nYV& zTH=~Xg4+z?KQC=06h84d|dD^$i~yF4k38FFq1rv3aQq@VB#p>VSE&7z!C>(h`1Q zF6HnSOpAyBq7J4C^B1T}8c|hBaOBw}vazBi=(fS+jj52rXYh{}7+&$?^-Y6!fGW*8 zjCYe3sSakdqAW!kf!tU9qJG{fqY8m(vLCQRM}E}pR|1poldAjc%cQ&a^fg#uMwo0%{$)vYB?MZ-g)QIC@H^35 z5kI#3`y$KGAB(m3-XnY0Urd-is~LT>bkj^*-w`G^(-t(-6cnV;57!pQdz%*hoW5@) zn4UAh15Y2fDQcbXoSfiBbg(Ve6rg{kPg`lD0IO5@Bt^g7GZU{AU{97OA^T+3yaqp=J{uliX{TUyNOXCIZ#wgtr zyQSo^`>ylGPm!6dtZ|%HpHolE;*K>w|5hYH^K81f+*mk&U8ozEy!~MB;MG?mkrMx~ zF*4{p(|nljsaB{rAganI0Qt)r9H$Wv2K_@auuPeOC^9k&w9*d+56~(Qn}vfydvj|2gO({W$nD&`nfZ$5bIW z*ZUOeg$`Z9wDOEWjK@Z=6NrV=kWT*P^7?d(i2B}_wyv>Y-DD$Z^8xO)L;F&a;9st~ z2zp-I$i@?P#Izd27si;)QjuwSLY)=7OfFnySeZZc^T60d_pYDx7aes+=mQJ<(gd$S zmEw^CXL{n2yzGUbu{Na7;^H-MDZj^u=NV@-n5oFG{25*ZpeaUS2>0XX`yKD>%>0`2AVI z?b#AEf9~uM{=X2C*azojq+bu8)OBJ?TC+G*<)U3ImzA{(XwN=;27 zmX_AzfvtKsMUTEJ5 z^VGY`U++uk#2n3Y*Va_kS1w*ZwTnz_VSqEo$a1cS4zSpYq$_scct)oi9j#-px1fd3 z^8U!mIGS{sXBu9Y)Y;V_j^>up0QkRNyM;iwy4FBk3m=Y3tVC#($KlL#a#!5VU^`~e zdm}4EJ~aC=jtAr2x_$ zP%rE+-a?qA853rm{-`7~MipPR-DlwSnhdy-@!b-Gcw?wM0vZDDy4{M>^e%w_rjy_Hfl7kZF0+psIBL z@#C^D$bKAQiuGcHnyG$h2tGB%O}*1Vt}39W_GW(6Qs>GfS^V6jtTUaH>6v!^FX?LO zv%IYQDT~j2UjATYxV#ZJoS`3qFnMb`bxflBSLV)Hrjt*CQY<_fAKFus6Ky>DD@8Y> zK7Z8d);I8JAY;Aj*oBYB)I5>MJbJo=MD4gz;g;%%lCv^i!LEo-4k(@Z>a?=%YJDISvhbW2Q31WPL5M#}?%sXAwScSy1RRY1{5nu5oOG4%RV>k-QU zo!nad{IyS~f~nCczZJy-19TRj3JPH#>cVsOnjDrUZ;p21`avhDQ&TcklR67?yT|_d z`EBJ*CulP_*bH=zDl<3o8MLx_0`S?Shrrd_aHZ}B)gAavEYoqBZ<%*}@m!Zeyw(+l zT#rh`ziAovT8O`qSEtE;Pfqbra#v!N!oQ*j{&)E|sa2dnh0T{2j*b+$ckk|9F7THQ zpCGTmR~{bXZh7#qEOLG{MV;Y;TS@id&)5M;8A=Gg-Rqjg@d#E>k!^Rol4*2;pRy+T zrN?tl*TR4A7_m~+wU&a(4HWj&7dnIDvD$yLC`Eo~{K6e|S^6nAKGr^TJ(PKvur@Z5Ou;sh-gJQOErad!z$ad(0Q zlDzc$oag=fJ?Ht!IqzS4W^&E$b?xrV&U|Jz5nokgabJ?XeDvrMuDqO-`lClrcpg1^ zZ2#i%1E-+L<@KXSZyw1@ebMyFJVfCbl6$m?qd{{0p`Sb1JCeQ*RxBw55-H?|2(|WqkuPW z{x*MbL%9F8lwSm%{3Y@Ke!nyssz%%-CN0Yf`vM- zm*TP%-9&h;HbKkctQ-(-u?1e&Aj;g`e2Onf4rAjp25ok|>)mrY>`(6lc3O{w$p6mh z&8!kgWKi*J`W~>j42R9c2V*f`ZP!q@-&ti&@s{#25Wj*HoL?C~oyl9I)NMFk@wiT6 zP<-(q`MW`$i9mjUhxGmXSMj0uTSc!EMZ3poW7QhBsN0O2PXW023NT@I&p*W+ns20b zgTDlK6Huez$6vmT|GB5j{rukcz$!TC=2IiHCh@Ari3BmV5-JuCxcA-$HKzL7=ncn{6?a>ZCtB+N?#*`xP` zF6zu!iYUHZu2&yy!!FtR@B)WEWo@yRXcAOJCn*G3NjCykE6_T@ok!F_wra1IO#ou; zt-)zk{V#DpzM(DZTuN1K=;wDLX_Py@$ne+H z2!L%P;98_r?h8n{iShI>UPrsEaiGUVk@9vZ7FCCSp1}gdjP)*ZZS7d{b=0g!%Qj@+ z+)pTBcwB%jdeS+f8n=UFF=^z-hVGb?hGX${ko*z40_2UPtngEykSwT4*|eKmXvN&v zI~5w#NC_+Q?b}ef7^uurB3oiiT37#UJ$m%fO=^EhD{k2XzPyLurK5_IvhyUk|LJg@XZr+DqTgKTG66mG@@=Iqn4)2pw}{={Y;t5~kC&GS>Xdwb z0yu6G%V=d-QdD##$q+58taRK8NXr6~GcqP@N`qe>!yAW(1*&x8Tl&Rc4Ag4Ra!X~l zAPX_Ki(%wk8=WZHM0G9KiKbNa&WP;2i|x5pAAPI=Y6;_aI!v+9_zt7kxlzl%)F$F) z+uXn=WPBv#TfMl35WHl!YQ;a>pV(3e@A=7nCDgLwbmjV>GxEl>ydS2z%N`dg1)9b( zgm}QdQjiVp@YFW!+l#r*2zcy&^+8G$x@wB$w?hiICW`u_!S&>iUvh;oG(^8vUU=3x z_O@`Z-a$6My*Ng$tyeeQq|7$C0ZeE2_VU;9&nA`mCEXqPv(>oNCd`-u2|L(`@c6AF zeaK#pAAbGpzK`fYbiNCl9=#PeH;R~xrm#w>&L|<{y=3E49U~{xdUG5CuYD8jD zP5?~5?ijX1InL6FLv=f!ZiIKFkbOE&?kVbSpmNKJ+2hRK6Zg59W%SH|VJ9nQgYK`0 zjv2Rae8~ZRJHO;}*^QvK7X3so=yKK94=wK}hU^*yL*lst|7A^69ZbZ!xU$p)oP%9`k4#ej-Hl(V{qMicOoU;(;Z=NNXU93>#rHNZ=JEQitEaX6&5baSO^nw{Ez(k(Nt7F} zmU7AWbK^IyJPCC80174vOpPet_Sbw9| zP=rUr$EOWKZNJizr%~i5DryxW4z@67E5Muly92VFJ(WXF&J3RA%y$~`$Vk3JIYoCS zzde{UAVL4}Sia!7`uQR6Bz{~Dp8-KuZc4`f(r_3LwE5c5@-68;_FI*;1z$)Vr0(RZ z(OKHn#Fc9xCXryOM0=oR)7-%|Q-Zut*|bz_$yUQAl?VwsSVZ(j8L%KY&d*t+6fpH1 zp-iLn$~U<%5RC>BFc$BKL!p{Eihn3iV;LWUkCD`2lYd6y3p`&maBk zG~A68px$C*QKH1tOE^Cy36o*C&!-B5bL4HYOp`=vuh~_B4!$M#_N;2X^H7Q`k`uGOJxOQrgqSkhB28W?0F0Qin@k8$9pH{H!nFe ztNkyRo=%i>#Y~u!B#%^6%r&51fwc^iK#6b|tXE3)n}kilps({mYS!z$!$SIt^H(XA zY>u5)wC8&CC|=t9Khq__-08#p?x8h^A)|;-lC%Yk!Z6l6BI=cSH7F?SWy2*-mt?C6 zfm4p8fWSMt7c?jp>KOBZ+?|FnO`bZIABq6L{9p>lk76zo8*KK>y#}Xw;?#RT7(Z=2P&U59I`*`J9dXvCtSkv~V zdW`;py{8*3McDRdlVQhSjjs8U^aXH}gK}&sDp_BPu5ts7eB#H6TDf3CQ&FFvQ*w-+ zJXE~hsV+Ic3-`O(ehv#@DldYV%`ZW0NL|EUv74h6Ib}XpLs* z$TbFzc5!D7_t%DS7j^X*grT>Hvf`I2Xn8ZiM>qL(bh@7jI&MDDUaRg6_}q@Aj>v<8D@f-V%1~` zO&fp8phl0iPCTT0$LO2lyC3AYZ5j^9Q&7>4xCYpYx#?b7y4cFN-{~;qsf<50AcN6< z{h-koQvEj3Bj|}Tn@&j&UvQ5gdgz}=e+)LOavVIyvU6Cp8gY3&E63d0K3kpx|cVzqRP8|ns!eL{% zl$`ic(9HM`m2hskD5Wo}y>NO%M*+g8xGOFdzK-QOOhjx$^!!Hczgp`&`_B6B6qLCl zRNss2UcIpX;MRn-#^qS?uIPgVpF6$<1#LR3hhn$+Z~99w2vH_@whICA-O!vgKeA5; z92^)Jkdnb2RbDRv=Jf#;Ma+>CIYy12c?038$E+8T9tjTJw4mWF){Wt(`l7zwv;wJNMR2j(U7xM=|b=KZ`}?Z z6Hea4U4HJf@pp5?3=FB(Q7!<-*HcC~&=czdAf|%8+=Jnc2LscTpHOF!i)(=AzR>Ic zpkIC&Emz#nfGz>id)Dk5S6Mh#uF9TgY^xK4oZ?4yHIv;lh1i5+5~Tx^qa<}l%fSAA zfnY24ChiPjg!i&aL6>ZMjLBdpXX#>^wb55r3oUD%%5*o2Bc{-8^c}9*ry?S!FsLyoH>8jsE zz-@qIzj+0xw8%3IHK%!N?PcsN9|wNmu5pHN3ecufjh?HwV8(3u*h0Mg+HPw`vmI6( zdF0zH8{?JZ`1|?gXe5?X(0~3({lGCef0|Gpc=OuX=ic-ICPT+S8hXk{45Dezcm^N3z_o@w)Re&t) z=r@&JdoN?ZhP+hb$Ps7vcJPVn*{3trl8`B|?!?1vs0#Wx?liKGEJL@L&lJpRz)}Se zsTwO**x4NGS=qDuf%4+qToz}^&yr8h0HEFz^2eiBFI31w+)PC}9&Z_LM8l9wl} zuFQTCkSnWu44xB~-9rBPsm=^!WSaL!MA~&4Ej;!8QtNOCo?t_R+l>3 zsGZT0Qd2@U3MN>t#g9K~p9rMa(Sc^VUJ7-aH(X7|Co1B+d7fAM-&lZ^)cbgYY94U2 zR-#v0{qokc=Vw(86_CQH0C(9ojN`~vzLgaxpx!6m?YCu(-qCS{dSF9?SqroOY`hyQ zKd$OApC*;iPj=l_ZSqC~H!F7Fm+@pE_o6eGuqhv2^7}o!KtIp(&A=67LNMua5ZpA8w`&}}ASJaIxy`~HpM1W`W(uYa0plv#8W`ZQ5BRo7fH+$QOUzDMja zF|tYwU1@!0rj|v8TmFcdK66V$$F1@)%FA_G^)GL3=h-<*yiS{x!d_cMhIHHG99v3R zT==NE_m5spHd@YJ%gt_IFC{pMrgl8Oe)jA5gOE^+`LjolR&`9hrHT`)n*7&yLzdn( zK*3+QHbNuTb$~!dl&s}2&r-$w$txscRdOLZ2(aA4()Iia&{$wOs9d10)BFzPFJz~u zeX@_GU1IGlkG!oK`l3(%{*{>TvsLVe7=G0$Xk5=5XqVivB$~U7%NRR*xxRFR@`QDz z?^sDas~kg!xaOCATqY!yu|`G5+P}myzdQSGae8y;6=hfC-&b_PoISG{$+VRU3>M={44ur^e_AWCNgLs`iJ=vW)k3w+wr|d{Q;vOZezCE?N?(uPG50R3k?TV2UPPWG&=vdoQs0)R(D=@G3Jz_5eCNr zB?~fb(x%cfdq>yh93uq@W_0!qZFO~RZ9dm`PEM7dU@|Jqs>Z1Pv1354a%@J$&&9Z- zDUFJmnLD7vvN7~dn;iFHn*Dhs*X*O`S&y0hH%{M5e!%*kxL3*Yc$J_Ea(R{-fU!0i zz741Q%AR zk(w8>SWqe6fWDBAypQq(VG80Q4v;=ZW>V(K==uM9r9kuEsl((cL(z6~u~gvlcn} zDk&w3jooP#6}-a&&K*dp1l`AbgbuJ^%8^P-(Z)-)g$svG&J=0s6`Zs76xkRD5Hox9 z8rjhP(CW>yBJc3{zbC7&MI@=F+kICn+E<()cEkrpRVa_!UTjMD>~g!M8U)0vwMNjC&Ok^Jv~)H) zoOMnSv|2TYQ?VMEEvK_Nn#{WD8^4;K&bx9(M>xWqC&gcl_{1_a&W$9@d3AaZNwbyaFDr?4z7AxDDJHuZy9q8 z7#gSDdn$|CS=ylUSXt$bT^1wvf%SM6rs=c8VcLJ;d~T=hlUZ{_^D5_#?N^t=>m*BC zr)JTw*9&!Ze)iO1Hp?h<4!o|F@ zrMBN6rT7$K{weYFu&K^8C@2ZITdc%fRoywl_7-jhv3mHIQB)^dcSUMM%WiSnqcbtu zB5fv2VEn0E_KbkKvm+2#vxYdIB$wI$9F}W7tA|En+zzU%4XAt%ehsvj%YxcXyff1b zRmR?UvJ^5!Xo7B*W7_ZIlot&i;}yTOsf)8CDigm)AAkaoRaC1@Y~qZJp!o{%03XF~ z>1o8*<^2T*%n?I!lw=Td#0&zdHe{xc*YJ8dj5=oMyT&_E}d$8V#a{^M&)BPQzGwZafKO(|qDWPL` zn{s5{lRgu-L`fnWPD@V^VOqSOF9%r*+?83LC|Nx}2;Y10Azo8ayWBgrEKy!_fTwo6 zL%?n8s=~Y{a_c~QRkiPKH*;4*vZqKu=rI#RdCGRi=L3~i^qeH83vHUgpa@`opGeItUGS8dOzH2VF0+ z6AtfiJsng|Jwv*Q7ZXKdLtLs4p9beB9HHV~(R0_M^JA_n2IX@!PETba@!VDj+zNlm z_C6bKSv*|U1RU=0ge;BKpH`!V9I0)VeT!obUc1>d^rV6f_G~A@{Ql=sBM)h$e{Ig$ zQK64g1K@YfLQljSj(tvkt#!8Ks^gN>TrL7uF3~1gF)5H*m(=WMyMG`oZzSdIlWz-Wc23k~&`J5pt8)7+XDLW1J=aejd^tnvwu;J0XYhml zav?M*HZizv@A4N!W5H9o(H-&}`P~(|?T!rrBnHSE?rR1BGH(HJl zYga#~b|G!r%;JzTe|hej4A;p7KPJ!1s#yiLj`onw&;Ov&n&0AK^wJ?X?{r{?5{@}f zb`>gSgj*}Z%bPLT>Q^XG^GOU+@%@$=X=}Fj6Bt&B|Vkyf0*x^9i5DEVd)9vNq z$v^G%on?1gHXSs?EN$S(z|VD;p{W493ja}z1KB_W23}NnAPX8JJp&o^MV;KXZ%f7- zHaSX8AaVUG!tvk-%CA`Ci@6kaUL{k5XKh6#AJpiZjK9HJbQt#X6@T`;*x3}M%V0>k zkl&42+G9Da-KZfD{cWEoem*tbz#g#()T;F5ImIJ%A<8CBZf zGhGx4H?pp3N%O?NaeVbFF@oHq3sQkZ#5j>4+ZAYAPAA$yh~54zfwBR96Uc~NE3j4E zqc>UXREhce2|L8-{6z^^rY~g??lK^+c5~tsfIPW;F0(pSc3;&PbQrFBLUzGxR36K5e2np` zyibZK1aIF!8!#JfG0kDmPDgP?o0RTy?mDXP0-9T!F77|GEiUV$dQ#w^>s}5N{{YK& zSEa}m)d|Jb*pDM9C&qfp3}a>H%?~q&pvXa9*S)Iy$|~tqN)_St_V;K0i4=wjMDSl&p3<$>|A>ndu7z{P0z+#+wv~(GT{+y>CkzM-7U`A#C)FoU%)c6FX$BFTQxSczWlZ z+VgLumsmV`^qZep$?}I>e69NzKWnFp)Hhj6MR(2+}jHoiDVEesJ+=x`L zObxP#W*?qryw**RO9cu_n+#qiC56s+tmGqn;&?bj8$J$BLCb_~kAah_uT1c3lGW5& zQGn)$N(4VQ?sucz`0|6_6lE1Fxol$fbM5vJpzPPN3WG-Pw|Inl@VTlqKSvp}_X+#V z;~2B6b#FuHx>>pY^A}hYTOPH=l8WSeh0N+kMh=98nMoNL-P0#C zpQIqeN|8Afxi7Y~hbN2;+!DGuzfSFINXQ42FV29Ps$h!g)jURqpca*r_(JoYQN-ot zv+#kQ4%7ABY2F;3yE1HdO;%=6Mn0M(0rp;w3>p>3a%MQ7V4C(vk5LA>S$T=gxhj*I zWeWXmES1y!0{>c&wKp3#HD3y!?q@rKWd!??Pk8uiFM9ftLeY_}nBLE~gVQr!l ztsER`S8@Vw{6q7@m@xGtKZ63XOp#^NWfPfyr2$!DB0>I-m#%IXQ~s1u(6%PPrzJl9 zfAP!K)m_(<(YG1o85sue#-^_b9n+;vkmvgO!E!t1JDi%Al+eak6lL_y`eqG|~jBJVKCeS7Kd?u`&- zlYnsV@M*eR}pwW!c5-DMeA)JIW$*kNB()0z49>Wfg)_srgFm@(Le6#TY^V6gLiI zsg3q7l&Tc{D-(`o(!uBI-3xf*ult9mfy&;}`h~olg5Hng>KXUB0{kkjoWgvo&EI+X zeb(pZM)^q*@2ogC5=u2lZZC!M=jX(e_eUH3Inoq>*aeRR^Y5gTxi=C^*ArZ)G${HG z+zETR1N-}G`5UNQUJ|Lf2+HrlMmLhTj|tiF)!cP!EWLC!{2Y;gif_vEyuMgnoCQaJ zPX5vKK{#r9y8bee`H+#)fO8`zw|b?X0tQ@Yx#E? zkFCCu*I#rMw6#^(G{mZn58QUs7b~&JKb158m`IW8W>OwO0C*^#0bl@~36hE0A z%w^Ix3D?!}2y8VpEBbHUSr9QMErQoIkdCS&*$Mb^DHOvlVEUuXLo+amp;klToeW4<+fPS(Cm~} z5pYs=^D(qv4PMOXqGvJBjNi)M7qgL6{j@{9r2WHMzDIVHvBt*5T=SyG5_a#-Hy>-_ zFZ8(E(A~)Rh0CKRfodB)z@y@8X+}ZiMO(6>3K?`VL6l&Db{qJjNG@mn+{HMM3Q{4cWCz@(Yyu&OB>I zws<`1GC$t!(&nPIeT`a`DMSt9yfQ_jWlLW)-z}u;gDpnGfp=1n@n5IsF)WxxUWOP(9mzk(+5{riovq7_mJ^ZmG?i@Ym&hr zgUMCy-41G{c1}jubg3>e@SRv@51n5$%*@ox3izMg)vv)pScHsUgk-=;C9!#56m~Jo zGyZEc&Su(?y%I&fjfqG@u{r@=0h0{bi;oQ9ADAO&?}-Z9TgzlW3ajAbGsJ#~okAIU zSl=IeaK*46O%^mthnA?XSHClet#?=TyAJ-BL+8()$15y>oW(tN9CNdVQC-4gol!S< zm3OA6{z3CMm%ML*i{8iT{&B6VlGEyB&ROP6Kc8>!70Qb~jH|cvnzMI}%r;_dgL36; z)FsV>7oT~L8E4iKtNHylWP2O3g2PFQW9Y_r{x6~M9+ZhNieu$L;~J&72}gtSP0ffN zm(cjSbi(@ls?dv%A?L0+Q(Fa8*ES2^I5XWOY}0F3=Qx!WBKJ!9V+D&Qxm1lDR4GK6 zS*O8!@;C|a6#emFo7P)ZzE4?>FAv1yo+(Q9Xq0_KiWpPj2cQrp5BU%Ymfg1LMXI84 zBlo#ayc!+T(+!sbnXmK4Ir=q~L?q=k)dN~;YhcF$8^4;L?hj+(a7;c<=X>gk!7V{6 zR(HEr{T}gxAn6&!QVZe9r1{xLgmXg3BUFc{%i(*EU(+^+F3NMQA!WsTtZ@f>>z&DG zIO-ZCm)D>fUbUTD>kkk$y|+p}_v9LM$uIrUO^`nX{MX|F^x5w1=M$=r-SIE;zqd0H zzgHkRbXB=U_bK8j)XvQtmK7b)N2Mnw35oOO?s(Pgt(zr7jk!05qUFE3XYKa%Gd%iT zn;vhX?4l{5`AZsjnS(*XQ+~HcrfV0u$Ldq3PaYVFx(jH=|0sKnqr~|pyo6|}xR{Q` z*ammJ;7;_Fde<{AL4xcss{($ZKB zH%Xn2wNF)WCHBk-jrtMV*eiam4_c5OX+!&I`42=l?^|0_0vHbnWy@wJ0)3(@0YwL{ zG6g9GeG{LA)qZIbXS4|z?eXrD?a6^Zlac2nz0Ln=1ELM;8H`W}n-s$z7eH6;?0vUXca(h|h%uPXD z2Q5!3*Vf)h?O&p^JvJ`f+@1i$ zw@oi)JzCi+=r4DLH>#oR5rz5sjB%83Bfs11>?`C(&}C-l!9&3dyP1woJDWR;m8`0h zzgu5W!EklsH++|?%WGlcM3s{RC%8wSB}e0@*jQ(nwMFFFE2F{9B zk*vVkd%XphPkK==UuJQT9JtSg_p$oN9#4txcitzs3$ZNdB4%!txA*pn%PtEy*_fDL zEmi30tae(|lw{8?^9VGpOB#tT>1K}Em}Jt?%&oU`*mWKgJM;S`u~?vq&k$tftRsoW zn!AT$>WZ%F+&c8PC$l_!I=lC+{v{b1P_||D^~=orPOK%~0HwGtx3xZEpsJ#@S!YmE z&>{+G=efVH@(#9*JwP=6M0pkDVB1kq;{F+S9Mu~I0z}A_4$F_kygmd%vlBgzL^aq# zypaa`u~$8iO}ed>Kkbh?whm9YfthQ^Z-`}kdPk2=X29O}MxKuzwGh)Kh7zV}I%}eX zh$abcR-Qi?%74KjF5zcbLt!Vl1y6X+Yyo4WeinaYa6cT&%Q1c<*wgjzx3CfxC{V-` zQd9+74zd4>C9FPvW%oCmaQfmu3DL4&ddUBc1^nNY4Q();uihdh)!WHB>2tJ){5g?7#!_W<84Yev=W8N?a_s!}3|B zAS)A7)Ah<-3MU};Zy~`Woj_XI*ra455C(;}wZlonZ3$tqa_4b_LqQYfGJpGla`;{! zw;nh3uni@Ue$+^=5l5e4CMT5su9@>pF7*x`$SY>}RjwQz{glIeHE~BrM~+{0)?ZOW zk5|vSmSAr51oFPVN;9puv)S1JQfnHbzbqb4!9QUw{n$ z^U(hnY4pQpM!?O@l}25W3WfKMtc@ws?rOsz&aJ%-^XU2@q%wWMT<3?PLH=&x*hwBC zJf*#f>nZ^b$ZWjYa$VS2%;AV-Xdy7V=V{13fEfl39nu_%k7FRRLomwij`x128gdg&wZBWz9AYpGg2c5imZ0Anb9$cn$1(sJ8q%dMXJ@-MshO(15#HNxK}5R8p?L#B0t5kSQC6Ewu7vZ6y_8saTzd zlHWfG^#$k?4`sQ7+Q4P%hYPwgIVn5huw}rqw~fU&nI62B8}wCcA4)n_vYD?PxjERq zc1jbQ4cfVIa^S2yO;uv?bU4vpVQdvayu`K)S4dKaMs+ zOzxmZy@vpO(HsGu8SUN~ptjSX4=maohSEcpAr4Ev-G9g?j({SFi_n*n4z%1&1N3+z zUZM?w?o?uJEwx^V%B%D}&h)wst@`dNxHvkac@p-uxBlq%AneZ3s5DE~>&kE*otZ z+QG+Vmx0&fyh_2UFm!z9OM6{L<6@%zEx<4gQpcUgY^?Q0@c~!A3&$jL&rW)tUx4iW z)`5$!mMRAmgrj&#rrE587N`2H-==Kcm_;cA3sN%l!EGP4Ibv1Du5vbcYy`<*0x9TJ zbSDp`4Nr4k6bOB8*RGqKSdjEa|7|=I&%^Z@uc_7SRxo*e!Wd@a1b`V~$4N|zTw_!` zMvfe`W7JB=mR79aiG_1N%Ys%^RgG*XaNZBFI-xBcz7ViikL!$cMKK67YL9wS2ug6P zxePcnL~<;i?w_2DOpGTshFB{E+(*^P6IO`EP>6%JI}U0RH#vf#%0=91^6Q;JQa#0# zZy2FI+jXl+6HjyRyt>TVmu*I2*Cngv?DFt8-2U!;NqBu`H9SX__GEC?fEgvUZs#_x|Be24YAc4Jih{z?svrfb3CdKpIdzd0S{3t|M$;$lFersRu- z=iNc>jw@lk3>UCkqAbiwyEjkxG#U{KB$sWK$gcgk*#5pNUbOCQ>X5Vf4t7oZ&|64M zMb^X|P_atfnwywY1l>&qq_nBNN&RLgd_EvvpVjh{`I6qXkn0z_{r1{yV^caA%GYVM zQ)>F5BC9PNnneECaGUTs8H!OlltEZq#jredR=~ZfS0)RSxxFt`)exb!om%jGQcojU zoW$CiV`@A-q*FYx`|wg%8QCf2<73rKM$S&>xn{I<^OilY#dkF!RJss&UmxU~e2x?z zn(UdFw>x3^V_bZ9bG8*qA6mxm*PF#fOb=Xn=Vm@-rs}s@>Gewsgr0Y>n_an@TV&kq z5pSZ;hGr*tJ%5DFI>I1rmdo<$6oT*&HU;LAEa|^s>h?!*Vp&D zsJu#JG(O8sY*@R90j}12j-+c9O4oYTxJmWM=COHSUXNAIykg`Q`pTHn=ZYUFc)pXf z(rh`hz{@)LQjrR!Q4ynvO>4mQSmWXLrJ_RQOC8ZO(&o+4Wb}>CW@vL%RAl4{T9Tav zmY}`j;eS|;eP`|vcAE&mT*Ags*b9bLdtwUg1D+`X|QIS@8W9`kt_*j6HHZ9qXqIit7PnL34$|;)m)*Lmig#1T>lUqW74%{RWOpB*^x<(2r;Ce!1Mi>Oj z4_o|4-0zlZ=j}*(^SyGSohfl6>tDOE6A3ez>Z#`Q>^@0(!YSsrlgX`_BmMC<*Z^e{=K&VD9jt=Ihlw6oQk-V^Ysc7pyBR zsQHN);hQ&Q61Do5pLC*ZDsN8z4OFUKFsfr*X#4~6I4oUE;9u-!mwKT>@oe-|IxQH;lmIuyvwX%l-KG&B8R*(F zbJOO;>Qb`x%EjPAEr1Q}R3vY0mO$!1ePSey+ryX|I#f!IsK7cw&F2j|Qz`C;!i#)X zhRmMrB=$=@&QDyJvg13CDA|Ik1u?^Kf`3Bk>&QgU297+33Ltxu6J(lFi*vc4hu2Rlc*B zs|RoHdYsp)rz~dl>v_V5MVJ7NK0S_2xD4lUfyXDuT7OLf^A1_dE-<5IFeuozB za>$>kGG*kaE785#pmNLqy-h33`idkfjHBjQDz!ZzRVB3_q3`2@EWTrUa5$9rhg3L~%GL!?cEbLUu41<`TFg>Ob#E5p-oApdoRd{-6 z`BO3lu|Pq#Qx|yUhG}vD>eM0n#EP_z_r+@wW6F$i%ID8z-4=I!A2LIK?x@pFNr6Tx z^WRtJ2|=LkP|>9s5mWhE24PY8FLd%dVN>@cnyB5CgoKcGNT@TKVU=OXax!6M>$s(TohB+`VZOzOipsp`c5xsR{g3!>s@8QbM}?~_x}axUaeVO z^@<@I;Ik~lMutl9{k-YFr9B-2_vgN+)W+0E>D*a?(7P#_zEi~X?YE2dR1=>wHbJO} zICO0TicQ!i=le*E(JOg%CI!BGhrZVB`c}^SeUBP02b0&hCg+5aYxM74`+0U7y83^^ z8rI68I%@KI>hf^6$8)pekRbHDcV~5SX|m9;(b+tYm=Wr?U!rx1-(@v+@9uW!v~sVf zf_yTD-rV))eE%yN468Vh$`35CONy{jxcw(;Wae_V6=#JkfUoK17O!!gRHN!FJ13x< z__8|#Q)RW~)Tk9;am}Jl&^SK)>w+q$!D!A_vF8AEFK~BjKtLaPNe-&o>jfyaNDQtQ zp|2*|YfPIGpL!1R2}K^{na(6LQMCjem~I zojZLrZ(RcB=21E&yQ-ph@von`#+;J#R zgXGvXO2s@zBgu^jXzqG=q01P4FimTkWh7KIBLKPR5aX_?1U63Sro3%5UAG&xchHhu z{LaP99FN|}%ZFWckr=OVvy3(l*PV!-bsL~h0J?|_ogCPxhTCR{9(2vPvo2`6L6j47 zb<#zmndLNaQ^!3NpSrhn#gqQTj@o4J=c$3J$e9oj8(!ewxy*Zet@;??)9KG^sFX6q>;Q*kJAZiZ~J6x_MbzLsUlLde_0c{#xqXB%+Lm&xI!!nGFRO1;>YyYP1XB$58de>)AH#h{U%5v~<7 z;1mvV=MYuYo2(>=OC9g={8iCd{P2T^Tm-Ei{Ld|q2JmZDNjPbj`LXX->jCKRvdguAWb5&qJbIccza+mnpw{ym7I~7 zOu&wZPmr2llwVR`n&^Tjo(u-3K>inXe-+hM_kQuCHA?Z~UWx^G_u}pZm*VbLyroF- z;shy9MW;_dCY#jB|Ca&bc_3Nk&$Zm9_SM_Os{w%ve-h=!4%dc@{L$ znt3#y?WU%POHe20GC`m61IS2QxKG!!Iu>#?i#4Ji-_ZPJ%I7PbIOw$HVbR0-y)LJ+ z|5NXcFZL#t4!gR?%}5W5>2prosHmj1CNObARCz@VzcSFgZFI>Sq$u2BY5RtWHJLZS zcX*HH5tq#9o1<~_$=V6mljzCFXIo2K?X;SM#4q+g^9hYJiUr-jS@&I?l<36l!YPNqPyjvP$e8@}z3vh(IprXD_~YX$r)Avu){d~(){>kJGY&uegWIMd(+lxV5F zsf_Xrbb83u&=QcBQOl_zh{cB;s<7c8qz!Xe&vqy2Lo@XVF>@97-(6p^&MZ5!SHzE= zz{UAQg@G-&cu*EcY`gg`_nN$28ec}d zh^#Zwr%&m4p7D=-3jRG`Uz73og#p4I-+(UH*;#;-Th~%l)aco1dEcVrbw5Q-099i^F*dR#-PjV(i^f?e}*Vm7?h|DH;_L>T2D2)J?k=%pJ=3 zU3&$Su}<1wUxJDf>&#H8x+FfB?{ansvI#LsGvKy3k{8=!xjL?CgQct-F3YB@23ke3 z`s`HU40Q^VR-tHQGAj|0fW#Ng@GsaIz$5_!7V1h-b7e=PpUK-d!<}i3Kf_5MpBUC| z4ho*lO=dpSYFpivwU-@VD9_&ofAq}eWm0Ci6of8~;wVRNe#{EoQkaOZFoRlR@rCZP zsbUf)2Dfl~%yA#Fh|LQ8`^UMu7}G*{7X?FUY(rK7Jt=MtQtA~PFbP_VmoS!owy%_7 zrNVTdia0O__!6nMyRL{>A%n`JQBMvojhgq;ZUe~!sCui&LU#v02=QC@2 zPy+fe$!aoleqq|HKp!G{+r!CtfAQEt+^r_~SS6T7p!bX`E~mdUqqQddPMhv*%8k*uiOh8EU|(8ZlN5`P#No=w?_ zUkNAm1!VtJqlv=FTD_ZzA0n>68>H$&5BH|1YnHG|#j_f2A`_K>4ZM@+^w8o4!qM;} zxY?|P?lBwFkW9}N)H`yAJf26otxtK=S_RH0Y5|f#aRwc<1TVR;Xvd>0hmj~t>>4M>H(^&EnObUSt2DJ}*?g7960Vc#D zhrrVM8m_|wSFMizIytA_R0quoDc!X$OfC=*1@m}nQ-~69n#oaF+?;Lw8?0|dO#)WcGwzwd zhNd_vS_}LwO9+bBfv->yx()Gn7wCIdoB+@d>Ph8M0jaoMa_vMy2&xL^=6bY)$t`OF)SA1$r>V)`q z`NP+KaFPdF?mipE<#2d*?&~lD-)TzEhMd{EX%IxZhhsV7t{nQhXE~u_c-ZM=m=0)} zyxo1pL%!-Z3r^24s#iM{k>fM;&Y-4LC!g(3-hOAwkxq{gtd2=i$yVNc%TmPy`7EUW zC|Y?=*|M?@MIpzn_%XKXN^P=PW%SbQhb;+zgvdv%|FepEaUVL8GZQs6+yCVv zqbF)KlAl9#-^1aK=61muM_vh6X?G2HJA3jvUWNthq;`ONy?c7v5~qhoM&W?iB#ASc zHQNh?*c06OEj-R3J|#70!=4Scv`UzuR**%yV-I)kte$RdHT;pgVFDD%(?eR!Bf3OWlw6}SSpC?8Oyx<&@_qT zAM8C|f^v|;&03&Uu=&ZH-+3s`W)-{M5P8wk=%$C504&OXl)*n@i^?RUg`#=bV)iTVo+|jkSd5YCLrnbiIY6T?8QH&Lre7f+Pvb{N8SKv?CsuVmtuhAmldV#c)E8Jm z_nQs3XweoQz55-S6qH|mZbxhX%A8EJG@h}X3+Lm5k^%)u04tOo%fuagA=5{-1ogwFwIP`^c0Z*;NDL}M$ziNS{82F~Snk@F0q71E5oO|M>EnC;~~^L25|?2qTl8!ucGV$qv@ zZs^}IUhhUyTVV`}yZ8LAu-N5DLWGJ8Q_?yJU#gY-|8xOzN)B4=e4hTyE8FNIiLFs8 z`}6R$u|0j|=qXrrx|6dOI+!nZPWs)euyc4eDaF#%t_zaE!(J{EPUwe#C*CIKJz|3n z)$TSfL4XgW1s1S?+%mV1>Q8m!(mkv2OEf)8vJs!%tZlMz@sYn4I5K4OgS#IW@4Pjgxy3@P$ zcZh0g>6Kq)RohiTPfuS|;MukA5_E+&eNQc)))1G4n~%sAMHvSNkX+_Ixc9vulFdGO zWtL|>au!?=>b)(upQiN`aX>PKbT>SLiSEp-^VJ-sFDFBc?e6{kN|!wW0To70(8|Hx z?(WPSB}oIVEGcxSqK7a$AwG)`7lA^_AkN`e!l8=O8;$8lcjtdY*M4a*b?60I$feD( zFaGk83LE_j1AT>V-Swtg3Rgy`siUK%&e=)B|91Zq+X%sE>v z+j7O24Wfh#UimWL>^JefW=esRn=ztLwKT%bTW9aV0+Kq zH;lp?f&O5J##IN%geO(%bZGF7uS`-#jpk!~UhjOK@&NiLHtBuA!uU~M1>>o;Oe7Ph zzLBY#+jJ8QbBl~4*m~@14U-Wzhf>~Z_$ou$WByZax2l0HATHz%VgRNv#Ij?%k(Q@ z!kgiQTDB(O%<$^s zj;=m=m|BPQXNZH;(7&P`T*w4l#;(yXh#^|VFFUa{;>!U^l8fHKCzAn6{xxP!ko zwqw}!-}8w=L0cuOc$sOB4Htnau{De_7UPn18>=_c`d;agrA$?IR|0!`s;h(b@`R!j zfZH8m5u=sL)^CDph1xh>C`?U^^|N~(9+|gxCUf)I9EY(1MVn#Rnw;*JZk*9CW&0!< zFRV7hQtr6u_;_KL3FhCmS1><0opjXWA`v#*mxo40?OKl>lyEkaIRwG>FRC8j0(X&2 z+|P+8xH46l(Xertyi@Sxx@fy+j&JU(?CkdyGbl)HznXWE8Ifz+QyNjHej(>=1@C3{ zbPlzhT0S=5($@m!qcUePaR(G4V!7=)jaFEm*8}0NhHe^i{%mHO>u!;U;v!0Z2*Xyeuf5?$h;ofIHanIe86^VKm zS$XC4I|@4M@aFCcpH=9_y7&`glgp9EEN4oL=Plada`cP*U zqM|}@J+NP8x?B2>fr_g}_CBblR#jtYb=MjBL6u-M4Xi(&)emrAM>H6j=eO zM;g{t1wHJ&4z)KzBEcmKb-=tY73ML@$};j2w&J}Gp;9y`5G$3N3y1A5ez@M82#4TK zA&penIA@AhuF8;-Mtq?83vD|CibT@H^A8}_lB9d?+~I}WChuD*5?WG{yFWZcf}hOm z*}d+22?c~W4EYCqe?_#w9C+Y$PB;WPf6z(Gf*}ujI5?kp8xcF<-4nZcvq@>tjuQCY?bTi@B5>@F}A$(jUthfAiU;gRb`)i10ko=l3) zea|2u?gBjg*~$2Nj95L*p0$m-{$&tb5UOY^ zZ!W|HClN>47wY)K`5Om%Kh9=;Yrsx+>G4m|lQ*Jz3Y}^>7NZe3Iex7scsY2ujBAwv zO7f9cUZlRwSrb#R71^Y767h}!#IZ5s!7{y@y=lOtq(wIaf-!iE|ASIqpG7C+11tOk zPKZ6{g&BS><%F$(JMilFKIz@!`GePRZ5vN)|Pji_pn&4>}vB2M%!L=E0 z`2>MvQ?7i$KFoc4awhu!lo_aMTE=WVLjr#K)TMIc#?=%STAMzP3}wC@{m~vMn>NvtVMH`M8w!ir2zQ8Spfu_HC@l+Uh?lWW|mu% zIXGYT$4pCvX1ik|^)nX9htN`9=v|tu{4@jn|6N!f1R@KuukF?O&?#BBw-*s8f^MKo zlVooz^5YsX(7}DL;H)NU9y*=lE9tx1{*THo0{g3Tu!-&Ak;nrvBO(9DYh8mfuR0JC z(vYGBRn^pNp9e*G<5d)%txuHB;FG^}MOGjP}4qg-g8m z-wD`U0JL-PgVZ_$N}V5cNr%y562q8Sa_TAp$64bs$>qi9-2>?gU+pwT|JCYRojYfsfXp-X?IsT#XQI=-rpx8-Ic zZ%rlR_{hou3wnHD)-xDbuc?XB1)0P3#v9(e2~^@s4fc=Dg^{w=VFD9a8zm<(pe=%> zpUaPAmpx6MTX=|vEXl=S#ezg$+Eu`T6sdPyx+ zbzLBK6N{4jFhZu-Kr8`=5{~W^V}q0(7fk;5_xpd(LyWlBPK2hWo0>};JmV3prbJF< zg@mT!x*=aZinp&Tzx>Br0y)jh6cex+E4^A1qWh4gS?xBvuyXbDP30*>;;zFN^dWxutDV$3 z3MhUwR>ctG{n^St8_~Z&+0U^`2Bk6UtS7EQ(d5_R=(pK#(jtFv^~@!Q2rV9ztD4bc zuL*^?ymy&7Ul76y8kb*VTsJ>pY_Fh(1^<}+nbU;x>bBBU_y1R7LJI_1dBGtzGLq`Q z2Dc6aiKopPCD&J(PCa+`O@vhPKeWtWAR`M4LJaf+A%R4(j*0nSBi)53U%j}dCi{QS zU0-{mh6evPf??s7+g+)q=l@iZOLf-X3JPxG;{O91H6P&NY_balsU5!f~ zTGNBnCF122ta=yfj8;}mf^OGkF)%RR|NQaaFopxDXlO9M(>B=i4JbW*)1r5Hx_UL7?2c^2|K*g{`<&EDID_dj0JSH`oZ|NrGE(WDK(YPe7L zJAo*&V%6y~6N-|OlRMU3cf34@%WTg5kM%8+7VpyNw1P#*I&4yBH6n%U0BaYar{C*% zKE%IJ9-zG#VFdN=`Y+DIBjS_@U0wQ@=ICpGE}weA9o*ubefD8Rrxy4{^KFP(gjsWO zRuJRk3&?Zk@6~ybaME^Om!&N>+uLoL@rENs4J6a(=au|n$-!^GXdx9Lh_c9ltZKH? zqmW#Oj7@bzNsWw$KChGKZh>_xM^xi%5!Ud(@W0Voqodg(LM&5iZt)h!B40O!hyCIS7VjMioV4~^*w+jTagI%4+?$fvFVfuy zY^*rc3in|GZZqnC^A5;nSiq+FTs)3S^1fy%+!fID3$K;n%SF;k%x?R)&8?$i_!$CH zZViR}K+11d=g0fKse5o{8%MYP`~b3IE|K95VrT}gz#~!(r%OzgseJCze{tqk&5qWZ zolC_39mZ^RXb9M#G|Rp6^t|o-JhpR^y=(Zh=0~#I(wsLuL$VVVlfc+ITHNyBg{i>X zD^-DdGjpR)aSWd?nr;*CiTp)~Z&n%g;g}Ep+V6$w$;rL?XvKbO-|#cxYH1`S@prH2 z(EX1!Wd&*ZYO$h+R>z7Ol zDXl2MClg|U*6QbYGs4^V+F31+{TJr@i?R&dG#<@e+88H$NzQ;w-@~|F0K-v(Na#ZL3ie_OWit z#{+f1;Z3lE6U(x!u((2mgJd&}*JSAud80BWTTC`7RaYPZg9*M8k@ZXO#DK%(2}S}M z5^Ga=r)c%uJ|)$88NzFcAZtzkr`Avj# zZ>VL%(JPFAyxMgix)88nG88R1jC+3l`*im`Lo^R1m-46+B^;Hpfw^VMDX7=s3Dk9n zinD?Z$OVFUi{QrYu(p+1M{Wir#S;wd*j5*1GG;xdLiZ~tF8H#2&8mG3>8KcOAujI5 zg2Vn3JiA>MysR0)xzIU*A@_SwJ8}>GeKrUDsiN5Xt>h8|bBZFK(+xO~PqO$7DrS10 zWB&f;?u{~u!_lD;Yzlr#uw={@FK6K$*{4d(436{!oispoPx!{H5=-aj4aDDqz9dnQ zZRJr~eSgm}G5PzekD5zOl6^P!1Ak~+X+B2F++X6F|${Jk%`|I{+4C}X!hCCDA1vxhv zo7Aae+g`%Hv;M`9Q+a!sZxlG?y=Q!ZZiolMjG#j)ie--)DcPfNA4J$Pb!<=Vu=$5S zYc_@^IN)vm`!_5VPvF<*iIkM8jFQc;fXWe(fDFSow5fUiR&l9ld_UWHeQ&UK%6M=# zLo6)3QaWDJC+q<3jYqp)H_!HeXj5?u+fEcTZaHy{CKAZN6_0drQo_+-8u5C| z_I$5mN^UJ&Di$x_DBG>8>YQfQ-CjlKjHpB64CmhlW@_W1x$0ziG{ooSLw)Tlr;Je_ zr;wM9VzUVGjsg3|jOrve-_mG|$STkU`P#lN`-wLHFqhs_DE$@7h9yQoBg^|1aT3N3 z>H_J~8#7$Ti7RYT^klVY$)~a5_F?kN#%1}y>e9rpKTJve>oL7Rmgx2#ETjOfSW%=F zCM}2Bh!O^*7|e;MW6fh%Sp*md8GZzyB6S}pqKzRV&60i_G?=jW8zcW9!u=7QcM^5^ z*E{UA-0of9Av>`HG(#lX-?+~CFMaCq_T#(GI2`j2d*A=OFpzvl>@Qfe2@}V`2K1je zC)F%E%i{L(z~HCfa&t`Yr)-5uTxM0^K;6oJ;!eT>^z`Wl9=~On$%seyoZ|+2e#qi< zNjQ65weJ#NU&ups$jB~~v~0Y7S2gDN`20=ncWhp#+!e=}m+2ZpWyHjK(JT4goaKDY zZy#}MtzIjIupGE}ZaDKtC5PQ2e?%T}igTpDd`I^lnW2DE@n=>}bQ-5VPNO{Kk((<% zXW@6Dy9Y(fV;!VIyCmu&0inEd3-XV8MhNQtbg_F9CaFvt? zDC#{Utuj0Ig@032Bi%Sn4D%Icr`Mg0tBMvgr88(ge=FnMp|0g5S#A=7x4C-gvINM~ z&?O*lVEIjs93bm3oKsA+`M&M=lLi$*N+=UA^yh`7>K!6(J7v1R< zRLman3z&^2daz;mKmQWy_eI{u*;o5Wp?79HF_CEzgl_l99wicfsq%9o^p3t|gw&^b5t?E;f zvfs}29+VuSc{9s%=EmlIu9?^de_i+V%bs1EaRl>*N6;ZIgS9nr08>;yUo9wD}X6VS%ht_Og;e1WK#lHE3D2YwyQHk+0>jNNc#r7~L ziabefYmA|HnVrKF4qYDAabOMmKo}M-#z@<6^vjsY!?{slB!r%3QV74c@ZV2A&~w`- zD(s=`=p+V_O5WunL`kkw^%=yRsnqmx8`sBnPxvO5Ou$zF!F>%waf*!%WTh#YwbOHk zZy3N4(40ySM3Hs3>i5FM&p$st&VC1*rE&2wqoqVtBvG_)HaugAE0GXqW~OOG;k33C zPx0xgQ8>+2NbI1YZS?+s6wt~y|10@l33r}${4bv7OyuYPN6^lH7@K#M+`+$=Yb~RY ztTVusA3gsW&6W9$Wge5BI%f}YOCKsE6>-TdZ9ht1fv7ZgSzAOFW|jw<2d;1jxoK$& z%L!}=OWRD)ID@J`8wTyz%gS{s^KF$v$2*q%GB<6Rlq^JHm!^>j7rFn7WhM_lx1)z2B0 zZdG;7`TS1nJHKFnqiY_-4knsE_3~W~)NbLJ=Llp6`oQ$xN%x1_TLcpj6KInxf%C+?4IM#OG*my|z$o(&8iiQy*nZdpq$*>%j%I%Pymfz(o}q0D+F zHK)34H%m;!ab3jQmSBu44<~$Cn!?>=7DiOBK**R!L*V#RSSzNa5fj9pRq?RhYDC}B z>#)5HlMY*kh7DmyDlN;3wcy3h>6+G;wECrn!)WEW0-%FqZXX<1?9(EOc9vW@MryCD zo>*s$@BxHd3FBPQPc=u7hptkNm;pb1*_aAgY?oSOuSMDIJ#LoOS)I9 zkJt2kcG76?#m41;5TC`?=6oV24 zul&Cp5OVGHvyEw_CcCzW4&m8#@?z6`<81wELEyKG@m%v1*SD2R%l=366|{=AJTDcE z)?0-N=s@I{%Kil(MR%M{2^4!Ctxx5ZHRII)Wk&tRc_8F2EvUy9)W*EfAE1V7caZ{) z-s8F5QYcO1A-lH*TTZIxJ*!UUVq{=>)Yfjz3~5BfW6RP@6iUoax1QS6O|bl?OI=PG zZ!=g8nMl`2MgBWd{`asA)}`N_yJ zS8v;FJYb&$nDt!(N^%#0Ueoi@UQuJW^CPDl#}0M5iym=^1cgem%=7&^eM?Az#+zF#Pu0@_Nv7;htCY= z&RjUxT3GG!%TE1DChXs}LrbAylx$P7H)sm^K(|DdZ#XZ|E)bQ1$0Yg7ZAA4VqWED? zY|y~5^OviTNs)p{dQN=B$4QL2BfJD>vt@$FB$P`6+P)F>u!Pr#pq<61k@^=%mqi48 zZ-+5IsP4Y$tIg$3Bua*NAVrj1M*~ffsdH$Djd%N+RPPeOj{un>6{GYlK{`&FwB}J> zEr)UpvIk1{9TvT8ens&#E{t73_Mb#)Z1=i`o^y_R`-nDkZy(E_0aA$;>9n-^o~IGy zvO?s!={1O} z28|(dUA$zAD}!>q0$%{SRqDt)du;*Vega}vgI2{l!A=GGeuoL&%^#~GvK5-)R6%t8 zeR{4zC?M_}{KBH)1c4S+Z3^%?fOSkY77d^C9=g&;fJ1~)74pI zf}~;E(ZYr^|E)!jz2-7qTmYm?L5pFL7IBY#m(?=m_lHuJ0w~ix zD0l?>Ony^xo4P`Wzd680>)J4>G#UK~cd$%t>RT;gvu_Cq1I$N^IY)8Y5UDVE(!sGS zCR%Ayu8IWPFdC1SOWn<4{CHdp`~mL8nFZ|LMKDgc3T|_6)MoE)Dz{xqA@rV~6lkX}W!v!79h3sv_&Ihg7*o^9zjoN=^ zHv<>Sqik|0?*IJE4&kgEVH*^we@U}cf=zO@sbS~G11VMvkEgcqn2iL7>>L(eEE}k) z%ptr&@QQ7wM4>dR_Qr!C?S;J-_iV4#TA!N{gl95H6BxhcURf#u4PqUNoujZT#JlSRJ0gbC8s>%5pe5}talVm5~ZL4wsPqDu?Bnljol-3%`iH2JcLyGQCzCHG7s z^n0s&70j^JgV@oLp}DZd7+mN0SZvZS!cMzdCt{yTIhbjQf~3i6LkgvdQM)GKLo5mW z$8KPWJi1hyU;?Oo^?0rju%>FR@DF%!l&$f2#ny#L2r9BD)iB+Uq^a&<7d@`)Jth`e1q=RF&Elh{t^j($` zEItJ^Hk&mUPw&Ikl7&`ZZ)DxJx}5yQ zE1ObuVjQ%(nTh`P)AK;)R7^szRt-q(ndCV)y3V(O3g}3G*XQb__>vZy5JM;EI zZz{lJ*LtS&+wowY<$!hPV9CV(x{cs#8$Oln=f2` z)rtEfK3XtB$!7WOzj72$94lv`iSA?-Po2-Er+qlikk~N`N%C< zQh1@Gb(Vflw;AMEiB!u_wcaNi9LzsWEc5TXsq{`s%H|T>)GvqlaT4IE1nu+V!;N zp61slPiZXV_&q2t=WB#SC_wT=SkGNy?ywr9e>3N)Xw}0+*TRD!lf+T>E(51uo{f;Q{yt|yKRVIyO71^|lyXFHA(xfv5Gs-Ou$D52> z3h#6?1{C1oR&ON@tx3{_95Cy0A^!l{49)m1LTn zyvG)d^M1wRsmxkI#VG7|L>>LI2->)$@F}w#C|uG=n57bls5eL5IY9B1T*vvar+sk_ zMY{?i-^s1&YcK8D#_ML*M(Hr6Nr7GEYN~&=dgpfDeb0+3bzP=5rIo@$E)hCrs*@5; zH4Tt|^M_|mWs`frG6=Lhzoly}Mg{0v{yBEmCWN4pu(;7#$)eSfGG;S&YH`K$Jr{X5 zTwtV4a!$nu85);u$0tbEi}_+KPM7@^e@|%g(Z)MqWU(PxJJ>>6%v} z|Ez2rMK@`b{3L%4Sk)0V&&jCXi1H3ZtUbzGnBjg}qlP+9TABD`pJhRCDh0~T@zSMz z?m%{)7C$E_lMq+?u6KNsI9HH?D~;FQjc4~{!{gaI=g@`M590<&aRg#}{n#Qeza&FN z!I(N-HkTEs zZIe6NKA0QenQ}Nhq5adH(b9f#(YWvXl9Zpu=VW;#%yM&^+>_UJiNoI1ciFH+&2_#9Cbt%r|V4&mHs>|4R@ zA}{50JsLm7V5pIl9M11ZT}r*nROcmrn0ei7OgHmemROVk&F*Ip+ziskpecRjTkkb3{FPk1 zS;*IM2LD^STb+)SpRf2W!Hur5E$%||kT$bm;732nP~#S#wO}b)JXyPqHl?9|vAG#F zG^n;EX0t5IE;sBgMgZt7>2#=j_S(v~=~XJcFuM&&a`JEz=I4V$sfX`s>;pbOM7#r1 z=LUR3Ytd3TXYb%tRpFoLpW%7uI)-x1Kv8&@s(aSlvCDg7|K|paU_Sa>n+@E5cRnfz zFP(pVDG%xGt^(2Q6~tEv>k|%RiY*~s<4fJhzRRLPT;QGU?jF+&l4MQ}-O@rUYm3ew z)Iw+V<$Y~>jsAD6i7&&4)%C;?yqfsnxHyZLnCHp+cW6}I^ZtAJR`;xgS@D``nK|H> zyfX8n_>(OE2;-_O+KG6x*XM-#G_~Vja}v*$IoIUIillHDli#g&^-T8vMiYC4usNiG zgzg%SD=&BK6jS_$yuFPF|Mjy>)1f3I;l30ziObOhyzsc43Vk}MXTRe8j2B7E1^j-E z?Igaj{!cIW$ln;ZpGTm_u4$E7DJykeZNi~_+JEQCYDuR6l$t}wbtL36-9N8qJGfX_ zCp*G(X415x5=HPZcnDwtPB!hx#s6Kqaiz$mF6ef&4!Fu%S(tM3uz5TeR;PhT1^>G9 zxtwmB5h_;}L1dU|dKk=FB&tqZ>Cr>9SQQ_Lb=1oMG8{tFt9p(kQ^?EWl+k&}NZwEM z%3*Gh-!3|GK5T9_i4lUbA2~wtvHSB^q!^2fX@imo2W;N5UJrANqlI2<(Jty8l@5Z# zZT`uZ44CNidbl(zXUR0uyQhJwy${cK8FU+9}{nsU%rYmeqvI7kjQlZ`I zWc=k_R{l}EN#29zsg+}=jIC-)&0wW$vXa>~Q2$>WN39o~x#RquCD?U3L}Q=__NTYr z0+BeUt_cD20Kv6KtqqV>M;@6z#M+YMSs$gw8)&}IW2wdq?H}?_9DJ5yQn7fpN^lN2 zDaXzEz{)#@g6VQP%tzXep);5|KIxh>=mlWp@r8wftJd~5Gu7YPGvMP#_O*&ce$)p_P%j+*@sPJ2~yj_QwAl<&hufy8K zeTNsu_c(3Q=k>~&NrH;3YpgN@axpiV$A3H-W(EGDN>UegWk{C|4yvebgb8Q%#yaIG z+z@Ud#ivhip~(=^Ii<~+Ry@@oR2UjS{Tnm=Kwk)Q(zD7FjE^F1iffK5=mcr0^|!Dj zOXW9K!|I|_$HlRVX(Y&dM3@x^$$n5KCCT%?F=adI;ucG^NFYDDlbRE}vqiOV|8=^s957Iwgp zqt1N^t8IHtZcdP!*Gz>}t_A=mtih-wBYB4?7_Jo|Vi%abAT2@R)zr=V9lBK%Xwe6EQ2 z?zmuhVm}ok7FxS|mw(9=uXjYpy$WBpZ?`uDJ@olfcA-aUULtpVm)px=7&HAv>vAU2 zom!98UiR|4S)f-~uV>?e$pc71%x?vK6Jth7@kv>^e~unNx&fyscJQ#PTnv&zD;WF$ zI>XWV(RffGou2-w3J*z;cjGa|Q;!rAs0GzF8zX94mv$fyl z#NaPwE+{H!vti-;y(h9iU3d#DDh-%OUDEZo;TtfiJ*fQqB;JC>gJlwQz}w*Mr!k4Q zV@JM8s=x6K&8!>yGAd=2fFE;@ZcQ>KF>q{3O7RFRpe27%@4c$N(IH=aKc)Y|Vl+FO zI9q7Rx2nF=@z$w>i<4Sl!oLx?dnSNBBUErVlv*)JEjnw(!C6^@JpT=YG;j)jcS)>g zpjMlyb;KLFOGDR3j83Oa=tJs4R4xXdWo6MfAZs?bR0FPUwl{$9{}{G->@!BB>9VvH zy(We<|HTg>?&?@P9C`tI*UU9DV?2;tRXme;T`zX zS#P826^hp9$J^#K7x*$)kjo8HMwuX7lFY7p*90xWN@1Uhm&!C!ZFHVONMRQ+@Pg39 zCoXZi7DvzU8@~ph^0^)N2Sikx@*(8k7Zc}|TvQD$H_eD|*3!rAZu${p?GLk)Y8z%p z(KUBz6C2I9q$GGNuGb+nG0 zKyMTS9)5qiQBl&iM(#KLyxC#kzHH1J-LkRecH1k4t+f5*(fM}Sw$#3+ibd}-F}H<> zZS^Pu>-Fu)y8(;!cdyzVpM}nly@K>ESArrAm426{vJ9nW&Og}Fb+o(SwVOPe)ZooQ zy$ytJB%Aa8#G<^KQvNet(Cagn&Ak!*;g!pNWu~d}t7aTI9wwb68pw6Btg7eQm=A(% z_m*h(Kas{7_Wv>LI{$ORzKZ*t`5!+2?8E;T9==N?{-bT;J|^Ogz`hYgZFgGd=jS^% zKEq)z<2H}~gYy6Vz=bn93w~Jd4860TtpM2sA1^f_BOyJ_1+_`EbGYtMQ#_u&2W!2o z8u5v^&&w30noUf-Jp8-IYkUqha1LnuCtYc1Hgb%}YcMH{JUNbAxxK~2g`iLImk(Wx z@V2#{?FR)mi!SK3?T34Js0YwGYaqyLgCqUbR$5wHGy~CjW0SW1c>V6qu-oVC!E`{@ zNp$6U|1sOUE;>!4A>$z+_Wbdb%~iH z_jySzRB&C37+&IiI(;TNIZuCjY1z+Kx|4EGv$^hZZE90L%yC>Zaoj$62{7M;8g6?u zzGU24WigEE!bRuQW&e!K{J(es#(LztIg0y5PtVUj)$4txiI9u^`bM%@$B9;BjO4@D3 zTs^i8hN|PGR|EkV9efB*+28H8Q;gSUBawZ4xA_szQN_+9s$)jY^n5IBUuOb3{96{g z-OLRPAik5&F`+e4*()RXDbMhDL+Q29DlNC30zM~20^A5rZ$tk`gmIX9M6^dquvJ!pS|pDG{Tja#!=~VEBg}@j*Qm#xaz)w>@88}3(H9o8w1 zit#vEPh#q9xru0#?$xZE3bzQ#b2R?o4Nw+2M$H=>j!sn60xepgnChLtrCm{L7`gcL z6y!|oEt$B?riR9V(>E`0rc=Y}!tQ}`zUQ&$_fEM6CV4epTNk~K31$;)VwM+|54Vn1de5xc5uoT({IWaRwIt?ydJOk!!esk=x8uo_fU-#w zxlkAYX@6xJ@T__bqjg&AILa*1Ez1Y6}QL;H5#8}6k*cjyqu9%B6A&hQulIAoB zxW(f#Q)KadY)GBO?~%{+z)Nx}o@~C%unq>?5w1B)x@A)N#CLonly%QzRBJXj7%I;i zIL!9Bx#_gnIg>qYgP)`v&r~pSowQIWy+;T!kb{`4QIms(wrjZ6#%(&2El9%bgq2TW zISii!O2L7Bv34nPT#7mtjGL%B?$%aMl`Jy=;JS#t4UQRR$2V92mWUfn)g+f#Mcre} zF~3Y}Cmn9QFxc~k1gp{M{+es7t=)i+?A82c6|C)SG2_!>=S<-SCl}DH@TSo((nh5u z=%E6z%bgC?%~pl*P)|W>+x)kTUII5bXfaOxm}sq@}L{UOC9h;D5*5l z;+@)5JGo^D_EO&&|5IcejL#i#ezk%aKb7r7u&HnhG^8_}zcP9MscE_8^uhBE!b7zB zi;&m0x}kM-i*1h9nl;a;TTl-L!*;-Q^Cq&WJIJQH&jVJW0mgm zh>gfF%3vcM+anPRl2Hur{lyp?o2XohQE+{B;@iuU^rzseUI}@5161$mOsrsIs`D+cwpL@l9^DcFyCvA{FtVMKs8=W8h%! z<*q1mI@3}t@X3V&d?|7{d`!GqMPfhsFytI9KXyx4rSWTj{&2I(aU~$6C9vb5%X8q_ zGbz(RwzyqfEXmq1+EMDCLMIQT#s9GKfFT6u{A^k2eNeU8HQ+@ld~){#0_J2`A30HJ ztVtwmqg`HARTRn`>eX`~QR#YxEyDHBObHCG?~-vU&5b$bzB?s#;qYzS-%v*7oH=zq zrnc}}KftfYxW8ZtS56qFwNIg$$|`Gt*3MX!2ff6wTs! zb6<5ylPeg|eg{Mqc-lAK=80iYgi(io>@kyaype|26wBR=<*1PVv)sPEAo)}coVE5C z?J1G0j!=qXX^@hGXKImBD}Ws|Lwjpb?sl{`$PpRFb0E2JAH&{WV^snXoQmE1WpOyK z{skwBAj=S;n~#_)CrrCSV3{h^_rZ?iXdHD+@wajeuB}s=rqv}ZvD!laopxGe2C59( zB~Cg=cs#j7^8n3cC&dnh6W8}uO@T5BXX^5?T6P^DLABB^`XxPp2T-=gvs;N)nRG5LxguU=!}GNcQ;nePC>VFIg0VV= zR_7O_dG0eLH>!mZ-wb~yZ3lvtBAhWhNEM&(B!wfHldn6cskAB+Z?qw4_fv{Xd%@B$ zb@2Y!#j5IpV^|{OM>8^q?mfPl)LZs;N!*n0DOv#AW^9Xi0pi-A^#NL2N;K1l<0H0k zw!%UyN%Ch0HQV>;Y=^g3`#Owf<_&3!m^T8xVy1ifHz~H&D`kCiPOw_9U$fyPWdK)k ztlSDd3?r9q!Q3}5Av@Apo~q0+k72n=fz}4?j*Vze6;6&opiv8Sk@ji*1~`|(ADh+; zd0rx$xeTNWo2u%cwtHN!8dRt@eZAu#vQ9e2m!qZEc9nI6&OW5wcJ(A=#g6f(QXPQG zC0)*jmei;`)b6x;{gl5r1$xRl0$QAiGdwLwF=8@16l&TkS7eHcW>^gIw9N7XNlZta zpp~GI5xOl~6e_?@8&X%)ZQNLn})4o{CkwK%Mzk4{-;ub= zM0RAsvSd@xepp|%xMgYH?6x*7<@l)7`b+34lzgu7M`sU%O*iZlY7*wZs;Vk%ZDb}B z1Z~|Dlg$pUmb0jCI_@4F8yjYNBrzQPYRu9;$Gy+xNv5Vn&zb?a0 z&+P$`n|oGMr_`*sby-#JwGw4z4SC8+jqOwV@PH^^S~?JLf7%;^azMVw=2p?-BV$n% zi1z~zFRbZ)(8mqB-`35Fxm+WN*WKuQereRPWb?E5?EVID*B!#)qim~a-r!KwO=RN< z^N?r*tl#KK+gvqUjqX00IqA)xT?3Y%PM6TVO>Fh53MAB%uIr|%oLw?WxdfEn} zx}guWx{UEQ3w{ql5@Wc}Z6We1Z_O?waC`_S(X=)aivp!zcbre@*;?enRQvmSgn9+( z^(+hN9E6~gloLYRLh5Sqazo9bRnNm?%Eo;L{QPYO9=tNq{qiR_$#JnVtq?*4W%%Og z(t;@Oli2JmohDO}+S12g7Cnfv%VdpL_6-2ZWQY*DP`QU+v_&P#a%AW3UiofWWy{Sq zn}|cf!>Lz?SE2Tc1fobHRvJsTXbJGxw~77q;V-dh{I-gJI9K*;un2+?m{)cV%+WeH zICucsNb%Ct{g^N>U1NacUw<+wfj8C zD&l6^;tKE>?kwhH@2<=%UN58-lC|MCwvV;gcEZ)lSkNs_(MIvp&PxA|#M6?Me?zg=2q3artGl-^|LViGdEz=xQY$u1_4>2wf)+}4Oo7CT&gS`E5!bcdwGB~7( z*XXNZ^IOtZ-vGD;gO&+g^1kjM4f=HZ5jyPGqNRWLtHE<8C6DH5YqUhGE=c zpc5bz_%LaPX126DXT7KiqQ|D%z~n>ddF&|Hv4252#!;TKi*`vWdu4H{w^P*KvV_j( zIA0}+R{z)~TN&aWU&oUb)2^t}Z7j2~7^U||V9Ih@RFtgY-i*8V^*F#$ym?@C?^-ei zW~F-NG5ASDBp`sQE~P3NXv;Tli)W_O#1%>!pRzR~r4k(bmy^>`&C^laN=@axVU9$J z>}b2I?qkJA;xkP-!o`lUuZ?hm@IJ{9Gcwvh7|E$liSx4LTXJGj0-l_jUOzLK(yE*m z*;PYuVzFKvf!gD1cC24CK?};BP(s8GIprVWV6=yY=-}$!^6K{{`yvtNPDX-l*L5SF zAlk(zRElcd*=oR#+U zhmvCCDiT{+uDI2Em>1&$S;W={y`<`KoXl0ik154yQ76CkZ|CAm2;D`iW~gDrY1NX= z`5tbX-kpB{LT<%+;+2aBh?9nd3Vy%t9W2X7e)h3m&Mx+{P<3^!qM)D&d^WVJns0GZ zc91L^=uh9YS*igvY45OS*|KI4E~<#SF5c;GlxhFNV%xk%QlKxgVEk{nLj6>xRw)p& z-XOGD%MxBy9V3V6{X8bG#T4YgrFA9Ms-I$Qscdfe__|^w;r-(f`fxRx{vQMOmNyfs zbzaI-$(1xC1y&&U5u?D;6|bJSHqLH~S_dByB(a;5I`KZQJI-$+c^)xa*nqiBh%DS2OE5mj~pq9`Y;>9?@^&8#d;;MLI+;M6^c1bz<&?zc*W6 zQmGfEcfrF+AKv|?e71;jGhn25{0mJb+*Kkj8SGZkJ%kJz4o^6UKIU1A>}TxnaM7sE zZF5~Ri=-n5c*xG;pd)LMxTsE)y}6kX%3+%qa=Q4SiWz6~U=?M?6NyvmL@F#=MMpV9 zCY*4bFS>L4fjN+ZPBsN6=4i>IF(sQf330VwsT~MBn+os$BqU2B(+cC}C@8;hbE2h3 zw8}=9)ytgGhrNwo*{hE&_6+RH`~7B^>qn3hWJ7caP{P0_==w~D!u$+M6|NhStW5&X zKzXNS3~Q4uqy}5P+}xsVlF}LY0$9~f9_qWh!nbKA=9dNgGLo@OsF1`~8G+&(^+OGa zVf?3&>br+krJOZW)T+g%j3ZOb(jqz!xi+8j-(?tos;5wR8l%CJk@Z;g7=kQt5V1s; zNg|K?1|M zGj%nb9eoXfxi%%ry^BW`RNRs@yPu!V^>c;X$_(|YrE*7`*m*kU*)dE44TB^XK`yI* zv4r*0(`aVSw^cT$NYAJ3guQT~Of}>PU}UJcaSsUgHsK;*c(NI4KD_AvxV$2nPr)c> zIq%ayen6HFqyVQROWO;F!pKe+ZF=Bzrx$c%Iow_7C%FHAV-|k1CIMms`DU zN_?y<)iAPh2pBDR?teeqmTP^+As9rtlF(PPEA)w1QLJTN-P5Z+Lt)CWZ#BB!up@=D z7umQ0rwd9L_wuMO;~ADOi(u`p|GKi+>AuwZatZoxDO^eO!T>u$>t*w|F3Eb!TlOk9lQN<6Csh4H~7 zs%M$E=9-B4B0r|ZPtw>UjN;!S2<=kp9K+{yd!G&Ewz^6=nZOt^W|Pw8ZyfMWoRkR$C-AA`Ey-?3DWI#C_@0>HgYMn>x z2x=@^!HHv{RTifZi@EQ`HL4yl0VNn=_NPR?@A5F0O9X8PdPL7+OE=D{nQF z{y~L=xF4EXMXRddGRBX!%2FQSO~oV3Z9G=e|8Qus->SVriCs|i)Fe=u{3vPi3K)emW1Y);HH%kY*W`;|!U(MuCCl5h zZ+Z=m1Ro){?l>8haz(JxB$1GDj$1R?T+gHY6e|C-FyNHeOxwqGjfIeP5t;y$$Dldm z!r77U;IxjuSRdHI)vcTWn;(rM_Y{vJ+SrHhl>M27)J4V!(-h=}YXI$Edv_nYrp2oJ zkUp#)VInqPY`npITgBvThG&;sU+o_jL*NC%6doPb&BVnnMnWb-Y81l9pLZq2JK124 zlK)1A?gF{H3)?l%Au&A*aLWQj9{r3cy0E|bEFFzhxM6*yFy%hCBIhVP4zmRd*4iv2 zqVW$xziJ(uRq*<%nW1KH#6pNo&*CV@b2SwXeo*=kjW_rUaS%48m75A7(NIrWug?fUG1jixJL6UAO!DoB(%r09P0YfBnFcn z^U3~;KXWu{V8McBQ$(XlL^Obl_hiI@P8a&o=pr{JeGkvbSycABgKy(=M41$!*r_b% z#iwPyUfmeg1mbvZq&8LBns7x$^n%}QF3&@Hy?WTHTNH+O_S~Na_snc>>{;=foq^v< zKO%_rNLE+g<>d{e{+f{Vfz{O>HsFKEW&E5;V?fJlwV!r;-&iM$TJo@bd}9XMm2nm|MnoPFgh~xsSr1KUGJ4!d(Or7-@>gb-!yN;UXOn7$;2} zoH=J2y5<^n{T$?QF~h3x(ZSiF#z?))LX=1iguP#O_143aFkURn>s+V2LTn1E8tJ4sHAkiJe)T!)&mczuE=CPL z-d7YVmL$Aw6bJL1BpCOZy|xhx-<47<+clXiHYtyXFEa13+SC$sDsU`Y)d`R60>xPv z8HLQ}y?z?*P(NgPA87-IdaXyKxJf8>J<T{FUFaedk+cp9h1m-RoAS82wl ze4Jp2Kq%H-^-nn&v>WzJ6HyMM;cWH^ zZrpvk+`9$p{Z8XoX_}bCq)KeRhbZSok9ENsDa;E3HQ(4N*%9ZhZW{&yxblVjp^##O>LgbLe|Shu3a*Wq0Dy6T zB`+W)xr{;8EK_?fc{K2gC_Yn%`JRnm({}+~B1`-W9VK0>1BrvlTD%h~9ycJQshs6l zGZNu1*$BTgijYfO3x$wqN6kaB;BlxYr3SX!&I;mLd}|>pBjR$UMoq_*KsI}sir!&4 z-)X5*i}ONddGN_2uG2!=+}7ksWbkplR#xOw*O0z<8zrjB08CHeQ`af*!>W}C@D3>SdiLmLx#8H$+VqR_4!g%&nYmWJz+^u$Hur9n)-7m==|2| zV#xGvY^S2Z#O=>QjTLwaWR$|k5p&E=J=DAk?^)5CZnVtDt<+4c?=35(6X9bske-7C zuGDz4XmGWdSls9Yr-zg=Q29iyOg*|;MFXQ7gN3%Ut&eJF7O86HY|Sdn@LaV#2QUuI z(OZ|9R@j-jmxC9D9va>bse$PVawK4^na;NvYM;Lc8N#xYKf*}}e^<^Mr2@IAmO!6o zeT(kL2Xu+zCbE7nT7QHv=qOP*UpY@7^X_*H89WLN+u-k{y2zfglO$UyLP9`zi*yXj zEeQ7Hh%hG=gw7e+0+6eO>uKrhhe#zNI5es$sT8rs!;-@uAbMy0X1jYK-MV7?4{W%0 zj;hQ-oK6$_jP}L45N+I?W`|XH7-?i}DM-K@MpuCAB>gvuMEP$^lmC-K5C4|4!nwnI zPQI2Zd%|9U4(H@#rKeXZ)4<-y!F49}TC;Pov1RjmY#afh0>C91)5+oBI+b!;&+CQN z_UC&%BA@!J%e^T+KEA(sHj?O=m`UmBxY*cg3JO;ltB;;LqhtM%2ruR~!%cS(ElH_r z!2MqF-)EoM5P)6?bUdC%$O$|J{u5Ei@?&;*a8UINOc@Q6Mw^ah^P%!x{ufGEMI&Azu$|pKIzv=3( zoNbB?IA_FFPxgJIdhQYAI@*?ac*?6&A$ zFlOlj`uteTS7ZzG1Awz9-&Es_kf(`ie2%%n|MDuAR(uN`QC$AxP0tqu+{?EfZQpfK z&pdYlZwcLE$I!QO1)BWd!DBOM$>>G=eRb8iSCFl)mr@(qv*f67G2Wpf1_gZA=FdNi zaBq7>gluMu+wb4X;Ft0I4SKNAg+r{-$p81>-QHYfGxNh2_4f|o-#~wd5cmx5!z1ag+aB`aylD^c_SO2&PBDL8KQRmS4{w+O{1@+E1!Oq? zOn`k8IBh<6n6-pAzh57p_>k%M_Ah>JyXh><;!T5TjQu<7`hrL0W5u@fAiE_KfUA%Qo|;N?mhy}{=5t%r+PM67_6KdwlaXT$d*Ov zP8}Qe+o*&z&TGi3ozJo7ANR4nm9~>?88PcE#jv_Lz$q}NPzn|XrVd!uqSV>RaY$QA z$4zpq``s0vwrx0~6BWf>SUJKw6_Fk*GdEq5AilUb%mBMv-Vmp&-Ld)`uP|}47KNEo+`6l~%DLlKoY*!W#ZFJ(jeODBC?p$7OO~^6NNK;rKdxpCN%mOs@ zxuP5PB@}V64mabwW&!}~*7mV@vqtfG?~vg=G$}8T?@y4{*n799hqWvI$S;*d z6lSPbNKf7hr7!%fn-Dg#vNr0kcXT;=0>Abe0CqWE#-Og=iJcQTHrRMUvTb0+ay!Pc z>pV}#Zd*Swxr3ro(BDn=3NOX|&Bkd#50^vu$4?Fm6=oTupDX>CByultWj3^79qfGH zA|2?O#WO?=KS}Yc7z4?BnWw_m4z6lbut z|GTfFQX(Mb2a4@|$FQ}#dIGX{O{ZZ*TFdMK3)(NqcJGz5DKa+FF-#)+g^Ao)5qU4yG04gnU&}D9%E|nOJtSboE zKHD8}J8w;wh96Z|>3tp<;qjb_*uE^?Jh{gvmwlMfdZyOX#>7i@-N|{9vw7yqQs#&H zbt0{5f@`F4;NFKQ&KvlGq@eqFSNZHJ3wb6m0o+BeQs?Jhl};!%KuEC+KQXyiYDCZM{!M-=@?A1>~_nN{o%h_H3=(awy3pahNZK?bYiQdt5UJvU3r< zt90w=)tRIywloPp5$xCE9;wZ#>^?qq?|k2UdPt_iUU4+4sBFyJxIF`J+XRYF+G(fB zvIOzw7JSM2c-^xyhR5i$>ool+wPhn_iCjUlcb~&|wN{eo^4tAq`QGM^?(Oh5t+TZ{ zJm2$a76EGckFeN2J$IlhjZLbv#$RYAtW2;7fje(GkxGqhb^D<)UuZ@{SiVs7(6ai3 zczJkukH2s;uY&<7KEq9x|B1ZqOOz@R4%n~vtdE&oVy;@+*eZsV8BOL|r^CHIa#S`jwr;weYn|+;+y$XGLO};0owHa3?nnKZbh+Wvm! zGrfq(Jw=SCdQPhLHkS1*50Rq+Mbsz}(Q&_Y%tkX^nzEk2G6Yz1;#+LQf`V4c>%ZBJ zT1NMso2?1Vkod@~RfYQt-y*F3sHrc;&b_~Uk{U(3movV$$BMz-rv7WpODMK-eA>Qm>FTQ!vaCbJeM3!5TeZAFHI`x-np zGv#pa?(=j8nL;M;5j1fOR;2s#{Wn@z=hW)a=RuyTXWb0B&oo%?{e=YIFD>zWEYZK4 z_nrE|C`uPy-^Ly|;A2lkXmnz^;jPinYDk$pWMq>&U# z@-Qdn#NV|a8x%jz5mtX}ZGq5{u^y%`gl(ZssKr?r^Vi<=$iMBKX*}r;7jvqTYkf`* z5*z-*io=A-L%Ybp_$oDH5s7^RZAl&KjS=rqo8~^vnNxnyDF90}+ZT{}41<6>jxBO5 zKfo@phxI_dz@37FtYO~yGR$q;a@e@4YLV22j7KK{@O0Iv9+tb&U35vb!`SLeo!cDh zoK=!lB2ke$0RX@mK^P7a#COvrFmSmz02vEwCuT)M(oZdz>#uUzfC>Egr`t zwj`V9XReW#V3WF0R1+k!eGVmXct}BPh)$GY7b#krho5;v({6Pww6Ehgv(Ive0t;ct z-0akjvWPAz56_pdXpGB)-d@I>Ap>?V*s6+@@|wjo<;1d_^^7)i;WGuNWZP}@6*fQl zN5nmW`+z>S(L1%z_|ke(MIR0f7uE}#Ks5X-W=+18Mb=LNjm`{BKHmC^gDh1O9}1yK zp-G4cGE@?KHKbFpw7kRLIf-v-6AIS+aw@n_dm5#XNYJI}Wn1n_cTVVIe}VW;o-O3) zsnwwvYMFQ;GH&$~r{6#nPsv)LJ*{qID{Wi7wFh<@LttK`lFIRk_iVm@#kT2B&>5Y= zvo%x1VeQfhr^RyeR_x{ZMU^LhGEuD1mbMm7+XX~7IB3`)+Q1e)cHh3dM|&qF?Ejr- z$P;FKs}MUd^0r1FfxzQ3T}L;^OurMGw79U=mk~S3U#N@R_-7xK9H;&FUZu|6VRDsU z>aA5CU*6ZQ@mrVQm8rU3DS!AVb&YwAoX|)})v$eo>TCmiH(v`7K5r~2ING)ImHtY6 z{Hz*7Bc-}+v7p_;VQ3+>yy&hW66=3 z-Hfad7MB{S(*hEi#h#AICM631eThak)oy}n@54MgEM-y#k-*F6FOKHsvu{g<^?znu z*EUI|Wy45zC^K}W%1owGAemZam3x~bm_S~YJSval0Myxial^mnV3De;K!>@zu;NPC z|LUrf|Cdr}!XqcA-*jZ$T#ARsChuCE@#~iQi~fv+9aym}zBv!%qN&MOvb%}@-HuYu zBgR6R%{RsN5g%PZOXOZwqp5|5kM00n!X)n}{~W7N?w_?E3y0#8nF-?By`~JlI-DZV z1rXTmwSb-rfG$)o>Dyu(!_E(@P9}(6?3h-3#}`J01gvsJoqSV*>zb)yb>_`^OM!=5 z@wM`9XH1?Lb&4$YTnS0ZOQ_VCL}YSosUw@udDjQn<3nAPQ$WU(SG$kpB-upDI zSTfNs1Mb?lDXfL-Tg@qDheti9C+@LyJ)7;rltA=X;dtMn1i4DZ{b*L%TXG8qr_Hz& zLj<;eV*$P2d}=EjONRtQJ}o_VFhyaexD&URKW*wg9inUvsC+X@+d?J>$|q3Y$-db#PX^)=*SBClWN4tvzSCm z>zB8Ju54nc^lK<~wugCEes#p%^OJ?&KNeK``$`emj1(zR(MBr{eW+M;{m3XEV#G(| z1I70OY-FN>*>x@k5}^0iu!r~k2ic7to|WZ$>Ax%<54uqw&))B|z+@>p-0r7q^_gY{ z1$N`*m*kp9yv*R+n~*WF_sNnwtG^U^IEXbFE^htb@$%<`on#*I(-i-RQU|yKzPG+M zE*hAc<#!kRe&20LTD&fei-z_IQv`53)rl8&tLL$w8{obE< z<$K5o`?!^Zt6O*Do?WPR<6TLRqE%qCu9cpzc5-8f(%SDCJ&-0Bek1&n#{v9OUG?cZ;$ z=gGaejdlY40RSx)s@>U^6VN6Evy#s>_uDt6RBaN+CSJksA4iN>%O~t9kPvHYj`jV1 z@Vn2^heaXFXstr^?N2T5Gm2s7IOY4(Vownf8YwLWy-bY0a)0|>Ta`4RXPe;aEsbIB zkMR(Ac%Oi+#P6Sz;w1D;fY&chT|a2?PrB0DfHxfg=)=!7sU~!{@lDf*q7yvxmp;9n z=dlH1J>GYH{o=2i`b|zw&e*tM#*+N2OkQ3d9oC0+_{Vjpm(vXIO%?BqW=ZMa7Zeq- zb8w*h{;T8mJ|CczN?{=X>QmM6?73JTNc4|o*w=^aBO{IL+z>*NuLOiXmkPlKgF{0I z0)H!!v^{iv@3zOs$0>8XYk&RvItXnzvM)97m{@tZss<3?<3BE1RexGpyUMYH^-4d& z9?xO`1pygu%MN0emX^-WtbS6)HR|aZ8GGgw087)q{st%1%6xp^R5AP;yb6R>791Sm z_ZMIQCW!j)Z>GiBo3dw|1-ZjMV~-gT9nGF5{WlO|WoaocBLlO$dI3)A>+5@a-@z=2 zx1`MFvUzc^vBh2vR4KybI#rc?-%Y>$&DzTlCo3x{0Ud)5{=VlkyXDpGG*tapcizSz z1Q8PIG~4=IPoJG`Q~{9L7~$V7yNkzq5cc!qj+&O1)(bLYFWOL_iGqUSyPGQ(`_fpi zS)Ol1F#29ET!UNO;?tOv)+4!nKm$7$&znRi$Vf<37>FU=-vM7<#-o-F!ze0MTink! zI9A*@0ka(Q5T&q#hysNs06Tnv<9u7V}p;G0SyZwVUYQWgi+Pb8Y@9cUBkQR0@ zESi4yHvj>r6!O0X`}}86=>I5;!?6q#6|O#fEJ68j~dLEaa=l^FI`R^o%vu(Upu3 z{>tu4F!pfBi9m1X@KfIvt(}N?E5!_7z^LzHq zMdxeOMxX$zo2?NiJ~2m|u;AgrfzQLy>htpr)JX+z6mqxVt9$y35SY<9o%>l-QbEqR z?sfB{ij6v+7MIm%t^8FbX1gUbJ;pidK%9_X&aw;5Ga)q|cHdhVJ}iB>Bd}@?&~$Y> zIXpR$qCnp&!bS|j!^=>uXwp;I8Xbi;byZ@CbTOn@eNB-oE%W(B`PF6KKvRD~bEQ~g zmiR2(_brY0gowcH4o-vA0ISRWG-b}oGf>bsH1RJOAo`8km05}+L95XkhUi`$03a7< zSy@ni3n`woG%T*fZ}nM=SfX86#A@+l#~ODBr^6z~n&=^@-j6GC;yC)FIB=bThn7W8 zVs!Bf!t6HpaxozdA>)!9<=Y-!!$?wPO_;=j=Crfu$2hFeLdNzJCN33GoL3R#@oi zJiwZcj+o9KPp=quHntR7Quq19GPG1I#c<1xpM^_rx}&xr@Bl5m zm@pah08RxV5YG%w8n4#Coswsv(Z5AQ){;RkxO&bs`qX=XYcFR&BFM(^Q%b zI_xxY1>;ym_bTGT!I^Z6?$B#^GTfIqLWak~gkDPw(A9)l^fw!ePWG$hzpBB!xHE$H z+8_sXDsO43;v5$gHkcLIVP%zHsJOlz-jOSIOWdt6$(Cn3YdJ)|F;Yo7lH6a9^tCyt zYt{@pHGOvcAXl=`K@^9QaL_&G&huuKIT@uX)Nq$iv5F=CQe*Qb80Q4^1-RTTtPS~@ zcbu|aRk887{qVWN?2ab4GOe=Kt1!(>mNv&H(f0s#-|ZHh>iDt(7#v_NSQk2r;}v;$ zH527>VLONF&8tkqCt(P+jqAM9x5x@(y>qJdtle`7+901j0?Y5I)TWJuYan?SIkask z%y-*G-R{d=x$Rx@2TXg>EItWhXXsHvuC)RSX}L+CJ!ST}GX!i?d$w&2s5|&3%|1~Y z2`=Z$i5?^1oxNTl08Eo@WGn4hw9l=g$$5(w3A~h0E%W7anliIhUyX6_o8;k`H?2bP z#;DFUe!=R84{<+YCNE0Yh1&Xpjh*T%n(Z}M8@!-31$#E?O-%{}oFXb5f$p=z$l0Mp zpT()K18M~;a;u0*-h>lvoa+O|+Ld>YgV_EGr)%BJ4!V{R;v?#D60EOsFf9qcLDP{$ zAzE^i&U7`h6selk-xX0^C}KL|XBUjj_P%bO-tCXoamrjDqd*^{QJu$IR^3~SV@Ww( zp#ZW`VRMf`Trt&pUFg?tkz0#{T)f_Y+O`%Gj1CsWiO~yPHI`7noLYsZBh(tk>)VhZ$i!Va0uR>vn-c?8jEHz z1MZ{W1j*a@KCdIr`eyfxU%$L`)pYPN#%^Qp6lr)=GPIqWFV~6%4m_)oYKO?_W=xSH zE$vRS7duwR2pHI;NaM#?TA&{zl<=^}v`$z>BPaPhhGl7JM}i~vFSJ0W^oab|Usibo z6j>H01PXM$I=(F0(4@AgsZ?pMg)QdW_V6}So=s}~S!%Yl9Z6r)VG`9J&dqP;SdsK$ z7sP*2GpzOMH;L2BB@FLka(}Hh@vY>wzg>%Cq0v&AvbP%2cKqeGyFr3`6fu1HXS3y= zoMO`6tb5s``E^dQcnQU9Pa(?u(jW%qdxI&~LcbUkPev*$MSP(G^fNynE->wICUyjv zL81`;sE96wcI~W@YN0rIil*D9;?k{Tk$a%k+-z~r3MbgTsOgjl! z17OBWfHQ~id~be7bk#rPQP)FsvTG0*dbHe5>yNeyP8>_km*0|EZu#i$u3mn?w$x*70bY=@ZtGOm=*r&lj5rKD1$TS$cz>9-P=UTO(Dpm^8px zdfvcP^<>F4x$wrP=F-h^(?~B&(3Yj!)zP}(3wDkG(~TZ}>o6g>eyT*L{ZQ#VgWS}p z$+E)&f9^6{Fqam3heMpg#T@P;z!&q$mBW7%O=@PkCUY^z9)Lrn2;)vY4lPakjeAnfZH!rgySJW6+ zf`#48u(>$5t9pG*UgBIYB5?I81(-9({Cg6knKRSkoCE!*iv*=@vMV|@c~Sr49bg+X zM2Wh^)G`D(WP&&db0?dgVed@uf`fyx(^$J1pYQ0mJFz#Dim=rl24uQvd^5ipV$7E4@HH`65FnMw zskc%l+lqg;onX{G0U{JAvtXi7H24!UxY738Ec@)TC&|6_birWzz+Wo$`v(Ka0N{-8 z?ub-f>xB+*Er7hm^KB=xcU!%Zs zpJH4L0%+Z1ho-OSDleoBQFkm%(zd^^ZhpUOX4#X1Bq$sa=LV?i$x^tM2JfCbt3C|4 zX#eaM@nG=IPC2i8q&28c9pX=(zDKH?&}(kab8j*Hj4-4kr&M8>Imc5LRD>Z!#C;=Q zWJVGc8oV$e4=uKJpam2Z0R5xa>BUt6EK9XEZYVB zAmdY!Ri0*VRqN&Bg7d?kGVl+b5%p{pee?=jcAEAvR{G%(q>(z9z>U||ZCa)ZW-vQ7 zyqM2F?cRRT0$v};(@ivZ1ZmT`;kv#}00rR?2`ITVXpu&>htFO_?JgiR@67|J6}5Wh1eSnwtke48)K>%WFVAsNrl}2k|4Q3P_o(4-df`=BJV2%%532BW zLF78CycOC8pmOSdc-5h)WtQXKm}*F$r1edW0-X}5 z%d5X!sULzQeH%h7u6~t2JtOO?$;lo!L+l}Dt#W7Ch|CTKnXN&C(Y4_E*$ZS-<%p zd}_;Ny(i2;#Jx9zk%K$#C;NyeN`fY81tfVG>{5Sf>PtcZO#M;E91l4=On!Q@89w2; zA1UiLye7R^td~F<9k(^7or=d*B9DV&WxDR%&RV;zs-THFN~lXHbe(4Prfd&V*p>cv zIwc3PsWErR6WDO0I$ZTRD+SAl3;dZzePjJ_W$N-=Opq4)>-ThFh&?S4qW0;JXunzt zxXvh2${6y41J5ffPeMKc5AuqFX zCWMg^%BfiA{5%P&DP+Bm@j;8Bx7DmoCrN*D5>xaiMHNyLp4pBLEGOOdY9CZo)zqM}B2^uy0QSrBBGQk@Vo?eGn1DXhMRUxaQ^Z7e&E=N`eWVH|;v_ z8)L5XC^I~dmr3gLsxH-+Nng!za?exHIHsho(C|DB%h(8e9u-besv(pgBR!fsoFz|x zGdK}T%iek`Wih`!1ocgL-2FWWup!Wq+)U`PA}akerEl)$q@}WyUL(2>wUs-fXGqI! zJ=;&4rdeg8LX-7rGOsrlz}EXTIoiWgSS+LwRGF)06Z@BeA@Yp$>$Qc%|$3M`Zm5d}K1C=*hQ z7b2tIhn))$xYi)iRw#d5_{X~)M|g&A3cJ8VOmpTGOTLOGN% z8zZIzxJsSt)~i7wa!15d;PC<5mf`}WWu#3QLiW{<&&!oj%XRg9`vxbNLE=s@_nWQf zx;+erTFQ3cAYzq)ZZq;!8z)RD8ocXU2w*5O*()m4ntP1ewtwvbJ{AuGHrFb$jARR+ zOR`IZiS6Ug$xqimA==4|Kv&`A_BFE;|7zDlhtqd-b*O9ekx^1|B10qQ;8Vcx@``DH zy0+tgwBLa>$lVW++b92!tBuDW)FSMWiFw(>#_!H2|7Wf9zk0dfnSbMj|EZ^gP0jzI vY-{egFRp_>wD{ literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/06-migration-dashboard.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/06-migration-dashboard.png new file mode 100644 index 0000000000000000000000000000000000000000..aa951e0896a78bbeacbe3ac73dddfe6062e550e7 GIT binary patch literal 72700 zcmd43^;cV8(Em#fN`c}~yg0>+1*cHl-KDq&x1epY;>9IMaVtTW`tOt#{>zbn2heI?KDYhPFnIoz_n+~Z{plaFf5r!rFDuypjJMGrT+#m- z-(~(kyUhC=L1lSqd3Gtfr;*a~jNtyk>~GKnw(s4H?iOx6y&ib~?vJLwzoMKVVm@%{+eR>ubg1xf1jTGj`{vFv^3m$Q=XX1>n7hoY=C0MQO+Cn8_G9n@Q@MaTa)w%^dLt_Zoo!FA+=+0hJ} z1^RhU`N?rdQuFd{yU^cZJBlO%!p#%|f3C02=cFCAUI?U-3rt;>_TO(m$0y0tCFEmS zSy<5NrQY62gqy547no|QL5Z5%f{o8+ol|u2D|lpI8=iin4DB4s_&}XsZOZG0jhpBj-D- zOzty?RlGnsmIZk|^TUrZyQ0aYnQYS8Y-&N_)<@!c!c63)=VVG>dwy%7u4DX@)9N%u zTXEBIT2rx2n%Li_b+vlYlRd7ZX@OAfN2m8YG0EdR!jp%qNdnHeleOa(CMkxTQh`(4 z2VhebvXRzF0SlxDfNojwEUk(ObSw z0(eu&k4)4cVz+5JDh+CW#7Issrd4y-P>G;!)kH3OmD2!R3By+za_>jSrQM=#&?us}nBlv30r+pX8r9FX3$h;C}ZhUQyaW_V*mi?#sh^0@*0v zVLeW+1h<^34#K!M@#6M8-R0GA_rbt{;Nal(R9LlP-Av)zZSY6K`n^n88baRF&9D=N zo;|{M>EGUg_Yg`l9ELrjO-`(!;gt1jXTCvas9ItSN3duspeoO<&5_Ti=VN7s)oXoX z-4Y@|f=08@-?m5*fSVrwuNQxxJG+Zat{E8V!9E|!nFEsyzLeHZH`E`E8yh(?DYQ6w z)e&CT|{t#ukCd^nu|NN73gGWjzVwbb$(h&} zlImE7hjW`jTF9=yVD`@b-`S#j*vwbIDj%$*bga@rq7h;Rx)Bmt@>#I`$3P{~o2sb> zYU?f}B%W+y;lQn{G5cXbJ;BWBt z-?@it_6YFMtK|2ZinL6853FCG0Zjz79s5@GGgSY~%rF`Ce(eI2 zeHYzLBoPM_u9WTw4f#l!1liP&%{tB35@y3BAHUZ9Fgw20kOG#y2NT`3S$W@*;jY&3;ffG<6xaHDGq=dt(wcXpB|01T{7JUKZDFB?} zX`p04=D?$rfS5yTsQ>x1c}N)m4pT4&`eS@;*%~xT%zX;Wxj#nSI#K$aluc8ZE*Qq` zY^iXZ$7Orn!0J%T!1&iUb1$*(f7h zOz_L4)d=IbD@!cnF3iKs%M`ClXDUDs8kGJD#cEu6I<*C@-W}_b;d@?sfOIFCwXy1e z$rC!hrrXZjf`v>Sa8zNOq`9J2cV?{8SDJ$W$Cn(MJ z3a0i%ySmFytno|e6-fZI8Tr{RcZa`3ST##e2y9n}vAT;@K;a3kU#i?^;Dd<`-wUImBTR z5;Idjg}t3d^JQ&zq`VxL8Y0=I)%s@S-VMV%M;Rw5rWY;xpjiwjYNfa8Q;Q3Ep~o` zM*h{rr;%|7yRHNE6XPQzd8Jd@i8M6GIo>tga1$gDY7CM|ITKBBpc{#S#E$@3)}Uh4 zx|uHhNfUlD@NKvEf_@WNG+wOZO_PAuiOBbHInHXzFJp{5q)o*+Xm=Qy&V84wR3o_d zC4znyxQGhHGjzIR+KadsP7=QML-(d~i%KIRWB7LN-_=~Uxg8dvCdeQhl03CXjM*8X zFvDR{rp@Gp;Y@KFF{%w?xRR#4JbIaQ+j@&05i;&NHoZ8%-Bh4{ zTfdvW)1kBLSXs7rWf|KvEguq(=R1m&jE*`jp%@V1He)+rqvgc8aB{Wc3 zdh3-ep|mM=WHqv&Y=IV^%GNhQSuuZzzMBB@q%p$(2UDbDaE4nyLHKuPk@pbuaqL`}X z&_5}dgV0LbK>Ch0Can(EpIsHN-B}!vJABop^JmR{qI}|0%`X1&jwo9abpp+-Z#MzM7)=(S(9;qx)VKDbKMoDVAE5X@&`t zDTMLKCa`oxt{uNP7v_ED-)h_l_L`{Ok_wIU^1{L97Bp_{VD}2%{GbQMp<#{znvr^V z(8eZ%J1@qD1~6ZK0sF+P)^nFck)bgwVXpAGV>2g)8rIKARm56J`Kj-{4Z4 z2i@&MILohFhPS@Vnk^$tKNONsElw9N)vxV|NDHDUP_7ROc}LG;tS1C!X#qT zi=u`tEA^&T$4&THPUqdByt39z+xzO!{2EV}Pm{x! z-=QT^n6lzoi|p;f0eYNYnc zA6mmww(|u?XSswxwTB!L(d3q)Im5nm5xF1A+tQgC;#@-wx^Y?x^Ru$tyRBMBKQkOY z_(uj_6_>gg6Ge0E2oQ~g-EtIwy#`u|fhI_SzFr8|qZgkW!CYM--#t&w<)9C!X3IXG)jvK<)LC~P8{OMMBL38Jw~(~0 z464VO4)Z%<;T_506zf-NKHvG0Q^x+RnqcR?g@)v7)+zeI|CB|uvP~!QE(`U^nT(YF ztdZXmuVstsW~26TigHxs&#KHeke9<8&7wTlNu5Gq_y`Mzl}$(`b&WNqmy8YoS-B>J zZ{YGe205cS@HEOrn)7U{(gqn2Gj2=M8-#6Xi+koS>Qff!*UA8LpGx%WU$ci;P^-wH zkP&Gf6Km_m1xo+ni^>69{aG^cSa8M-VXAcAMd}tZLDhspjI4CrFJ;~gL&hFGV zKtp;@(P1hv`bQ-#Sw`jV!BTDu?T=OpMrf|}CC(G(_MT%6jT&)Irm=~xqk?MUxSP_$ zAah@fr?DQPG0H@UCcR6$hA92W)WvxjQkLee#N(;9V)z^j?OUvtng3-0f%`h4Tx4DA zSpF&maU%=p>VujL_3;fjE9y}y;hJ5p_h<)GS)wn$nsl~p_kC%lzTX0JSa+TBSE=!GjyXg z%XO@mA@$pR4tG33Pzjd?=Y>dnSGi17SFvN&43lH$H)OvY#(kZ?jtoe~NZc&hkYk-1 ziP~A|(4g&k6?fs8W_kh0t+1lgV0v@mR>tgp(n0vFicK$gH<~Tc$MH3_s6o^29!Et% z!YA$>ig=D0tPZZ^vi|+gFtN-V^oN9~(Kzb+u|uD{-URxjcjF-SEfrB$tux12SDtrK z?m{#d?_>ivmaC3eR`yGRO?mc;f&vgLX}M+GrA@&%S@$TjG-s3Tn>7a)hdYCK{fh#C z$MT&{3|_+O%QOy`m;WZ_X!7Erkdp1sgZ#pX#~IwOa))aSnmc@sxYNKuLW)75G3Hba zLXK(7nwP|m^DSN6?_^QGt`=WU6Z3y@OTD^(f~<6eM@CYLQQd+`s(s5Z;qMXy=Gb-x z1@Yrg@iP9An70+!xR;^b_I?+AP_qBz?8;)Mv8XK+KXNjy?kD>f*r;YrnvXGM%s0+z zOq7MKWbC_>6t-;Z7fv1u`g~qyeb1eR=-nUcIc(=%aXtLQP-y9%e@p|G1l|e@uxk!7 z*Yo8ny}|_p*((LB!FrKZgG!J)b6CV2$AYtr3=P z74C&1^Pk7R(k28AywKx_45t%9slP@EUYGL1^At2h+D^6~c;EAV{&zpL-|x2lKYkD< zypD>LT9j7O3GmX%?_kK&RlajhvvR3!(jVR4QkAw&3~DT`q?(s=#Ukee|A(QnAaDN6 z8xvaKM?vwwYCQaRvC|u0>i3ECq7O7r{|89%Hv5`7y!dzS=pEYsc{Y`hwPZ^1pI_1D zY2}!-=>8k!cd8#og#WDn6LjqVU##x`F&eCoGeJnCX@yt612XXTj}1XK?qV?%mw}Xj z3N;8;*>3!a6*I*jxQfvk;P2zl1G-wSf(n>k&m9a*p=>H-U{x>a)^1i!z<#`$mcuA`GG}4Dm8LaI_R-(9-C?*R@{?Ooh?*{P2HCWg zuKUFvkcGn3W2JFfEVlF8K@Oy^-%sk`m%&b^tV*pGFYk8ubjMGQv^CxMia+F{C)=NX zRFiPK4PTHdEqx5b&uUR`Ozhx0kP_^SI{ZKr9o_Bk0dBhFBq8z9@Nx| zZ9`opRTi+{ymYbbLYjVNbK5gd6+xQ@}Vx!OwOnF@>lEq?~CQT4OL2N70$5o z=F{L7=Gza!t{{g`IQB~?`&L{V9Z&$)^6(oRi1|4wb>Ib#dH)oKn$t{To!0cU`1f+Q zo!V5MJj8)E9*K1*O<|J)N3$P!V@XlV#oQD4QeQEdhrm5JqWZS0yK|v~>$)cJ5~jA; z>L+XKJUE*Z7;JX=z2WvZtn+RlI}Kdsx!4?)38q19=6W}%an=Pc9{_S%e3BUX-vwS< z9;!K?YYkMA@NDCj4b7ilg>L{nCqsfW-zTeRv~K>%y|=mja&cgFaR9r&aLEb2tMPBt zpZIC&c8%+O9&mNGH6Sa!==IQGrmqdHGg2fK>{8b7SnM7}+0S-p?FK)j#V;E3R!Zob z&)+pbAGVPuWs8fj4#Yhm=YHN2cO>0L7`a!8D}kyr>o`VrXo2X4PIgi=wX&-w1U4RA~4tqR3Kz!mc-3f-kwn=VZG zc79eM#X83x#h3NYsJ~Xl?Dmh==$ey|>mJM8`9(E#XPtH5C+UfR>yS>x)L7Fygk>ZD zV?`lg5cfa?Y5qZp&;+rHzo7jvZfZXgocwy$D-`ei*mW}mE+Q4fS znMo5hiOX!9mdQHx`i`HQ(ed?89e2l_t%viFx57pf3zegtib`5E6JBDq5C|uQA=BB< zOh@q0nKwWOB1{%KZ@9cyzSz>tO;+D-VLe;{X4bMnI1pxD^n=4@zqK3t^OEElVga*Du2JC9 z-H@1%M9p9r#l5l7pqJFFqf&+i7~E^}Yimk#sDZ;qh7DEREHrIPiCmc8l(IJSUDH!j zeqq!l>>1W@Wv0ZtaDD@u!GiHB89?q0O=t$>xG0eHsd4cGPg?o0-rK&xD{v_Br&Q;w3eGt^uQda*v{+1Wvb9 zDa7jOe8K#XoXVdzx-+Id|Wyt0f8sX;S4WGyrM8S`mA=voLZXeQR?# zO4GLe0QVS`5O25~GK!yk7?#tdmG@k!q*?Ts?5l9OpJ4+&p`{TJJ?oh@B9i*ydb+hi zqzoH9Y`&=N>l>_UKYtLtx_Wel6PY(VV$ToJYun+!Oa*wH{&%<$=b&=U6d2=8Jzzi& z=kXuO$%rGP(Ew7?LOnxRAsh7#%IX96#Ldt{`|e&WVDYlc)O=P6e0VFLD}g$CXg*(v ztsqC}nFMx=#osd$%cht#dU^2N%|HUyr+m?hk;Assw+Fl~R0YE~yN=$C?HxcKkE0+p z$Z0~$mP%61{BOuCYy|JQ!mthGvBrsATsZ=hB&%ydgW)`3W2lz%1Uan)vdMFDP9;S3 z{fVW^IhOx$z&-tPr=xfG_K+oa@No0~W8Jz+Hu{;$D_QPQx7i8FafnXe`xjty+TbXL zr3;h= zL_!s2Yz-D*SJJ7d0xm!1fZ1b6L1W9DUT~nWTIfY4B9r-6JzmUXbXjaXt^zvS=vA;R z5!kNIoC=)NtbjF;mWa0G8AOHli7z6aaSRl*J_@S0D8_C87DvmX^xG_o{nx zRwa7$tBFfnjgR9gG2d%Hh_T+SpC0LAZ5gA`6MrWd%)}PE23RfX8t=OPx*?6@_MToU zugKF{P>^yAI5(B`_X0IbbGyWKiD`8CS8LR`V|DpBPq7hx7q+0+u`B?Tup??Yf1fk3Gx4B z0qfz0t1j6FfVyoL$?hnie`9uD7+UqSM%IRxDh5r#zaSZ^=;lob_us&RBd%fViQ4Jm zhN^`!)nUjPj!NAuO!)iHd;Rc?J*Vylb~?AWJk38!fy+~saYG+&KYKXNmu05ptF#Pw zOHqm}Xkz_F%KBr>A(EOuAcpt`=0h)j*%%kSa|AmKvgBQ3OSHbNsd*6a>-^TMnvd@TxxFzm4Gqrv@#aj|RHl?=O2< z``R{o105So;#>L4Y7sOb!}RbPswG$p@b+TnQ6+!%sIdLF-q`7Pvvs13$P#mQ{#5;I zKIwE~tBh!zBIwF=6xUWo2^sXLs?Y+dxXlXwF5eTqfB04D1=U@H1Oj zN7Y7NHxH*CYdLAuFFe*9VeP>~zw;dv55P0%z~t9DGU$rX!M{vVZ?qpVR(oY7LA>~j zGdx2Ww%%h`sC_DyJRR*@0X&Ef=orN7JB&Eh6puvr2 zjET=iMkt}u2B{{={u6V%!7H+D1IdU?K)o?1c1m3X5Z0m8)cXhC2GUY02Qj|I7VK^w z!nxb(pl}Ji3Ts@rVK#F2+~fee1aIsvcbwfL#Ale7HIu*QH;p$^ckG5^s3ZUx&Hf4^>t=!i?Sj+wueMf~pa_PY6KyO1Y*@|OxA&T~o|T=-R1 zGMwJAq$3@Koiq8E!_bZf+BzcZkbxpXJmj;&9PxL1&Cr8(`n{O9`+2=8H4Jrcs$1Y#h;6gGz-qmn&~> z1+sExK%gDbdEGx#ykRLVFEhW#C3?0GYh4Ce@Tz{XIR7{*ew$PsX#O$w=r#Hb(4%Im z{%ok-DJVi7z7#trjz*tpNzKdXBl~ueCHS{tK@U(a71icr%wBbo%AE?6y;_w z27r=Vu-u>nTihkkY>1lZLyy-@vm>@Q(BIPKm3HA6Jy>_| zF1xn&#+x0II1u^F8o|(=JJ}2jG5`Ua2^-Q)?~!dSQi6HaJVL%~)`h^mAZ5<$!q~0J zMy~pX`4QeY^M&B+by9F{XCosBt81$>m|>m;;7FKwsO?)Pbk2gamQEOYnW?9*k7js4~g=8#mdRjYxi1sdZ zPkZD{@WZ_>Lw(6Ye!W2y$=kV$Axka@L+;8Cr{>F98o00EV?`n2!O?CXp^J>=QcsQ*Jj|a-XCKWcx^#Sgm8*taVRg!cm zIx#%E49lYI=qpB?ZJ-;fai~9v;l8C)Al)W9L=3gAVl6@B4B@z4BRmW^j@<2BSlG(F zHTHgvh8D0FXu&0p3+eP7ZD)sjEWP7Qv|MJba*enWpspi9=Lc#6hAZolP5T#IZYwqSUS2Yvg zf_{VHG*V`b?gVrZKV4Z~ytIIY9Vl8|qxt-9GSp--TK87qFbB^*#)u1jdH!tsz-7xgAr*2gy z%bmx2A|1E7u>M`5nvpM%&NkH0Wsb^&_p8||DC%Mcy0q`UDn{&u6L5B8Y1Xk`Gjr-o z2Pdlwqv|Du9~S^kRCV7Zf_|Q-xGegOCIN@`f%B;Q&i37o+!7|jixUWq*wvKTq<2&N zLExq*6Ha}{qW2SOJJS82M>)87v=SYhy#yVdi)-jOKUr66pAZO!KKzgDuOCbpAeqy7 zj@BP^wi$oFTU6OKd5dn^wpo0581~-eu>oiNI<$rV30m~$NAv&;!OK{EeGFLI`P%8h;*$3nIBcskkPhR#ruDn5BsrM(pXb}wg%XFcf8I8>FPFlg0@2U z!gAyvwL`1zXZCJn`p-K8uE-{O>S_*CS@-((Ej@)~Rz? zJ?uy{%rvZmjFGZ5Vp@;aa;Vt!LYq#Dtrwp{7%fp*w&Lucyrp!PrrfO)?h-rq^ySS{ z?aHg|%lLDEUzl}tyx1VdZoR{f6e2?x5Ay#XW#(&#-Gau+bk zn12vNfge*4O-XYO^KWuZmZJgh_qQ}boj)2AWj~X$vA6r>E8>G4A>QX?^errP$za4W zeq{$_pisZ<3JyNF3spAKq{X6I@}KLlV~qJu3bf<75@9BM8(?fR;Njz(D=H%&O_4f% zdJhw6-|m3^`Pw4^6lxo*oh6nsi1{%H(2b6#J|Jt|so?$oXU)W%DL+mOqpo7-NTYf> zobw6$`i|`w^qoj8C$;Os)0Zzvfbn>mWp8BeQN1zu$D3hkY!miYp}DKaAIQ`KA^2KMif@{ia%5<$=9)44+=3Mo*{I#yI zhFF2W=-dC|OWE<#d{25|czfH@*5v-1Dp|#mUxQSRwXl$3%~ex&VSLE}oYnrreO|E) zS)gGMBFV|9G*ijl*EDvV^W`l;)dN;Vn$C{>I~r=L0};`E+axhbJ>4Xe2oWHBBauo& zlaapYc}Kv$no0<11-HJgKK3<(#DP~#4?kniQJkur??oRT2)&I@r6c(pPh5f6{l_wC ze4c`$wviwCy>@UHi3Qti<^3}u>zh7Br94H&zHZLe^WQ&2VyrfCaKa8obdA0-H&p0N zk#z?iV$MrtB2uT_14VAzCRItAjOy&$`{ozSy9w=L7|(4gWo6gA6-SoiJF%6`XlXgP z)3kT^g@q#XV-{_IjjO{9vD1U(y)!eawhpZ}DEyqp0`cNyXNu_~L4vYA9~wB|JP>GL=hOjT77Yo65rkw;ph(ln<;1)a zOkW^xE^4bK$$hS#b^MxUw=ULAw5V)JUx88xZoU1osM+39NNB?C=m)9ZXlg7@eM7q? zp1lpSAjI@_c8Rva1&=&uK~Eve-oYMNlx`vm=ZbH$Pd`z#;`{TpkI%BHfPxCU5Y?R+ zN4xTs`=Aepolj%REZ?9+djU5jCARg zQkpFO411aIRp52hiI(lBHEmpM+G*`%BUV25cWa`mh}9suPpGHgXTA=aw(u(KC0chZ zumWFav0}WKR$=Q65mC+cMF<%BuJ#NTiA=8uSNYBJbhXe=m&^56WbR?dy*B8CDpmH+SRwqbcfB7P#L%9D}{MLNSS*yjLZ5&NoP8aqGrli$_T?E4R=m{H2we<^Pr?u!bNGkR|Q zEnYa$ms_4Y%YQdr?NmAw`jZCfC2Jktx3_>}H5*6WnHH(%xFhP%!m9NSlaqFurPtSE zqlsB!<)wAi{&_58`KRFRCtQSa(Zqa0CG8>KkA^-iuY6&VbR3FJ-7DT%4RjvaJYsUd z5iawWPnUEUo9tiSUUMzRlb!<=w#Tm)3D*^sweSQqO=i~MGv0UcZjbH?G1glHL&OE( zjRn!G);BFD3n>9m>RY(HZh3-`kB?__XpthvWUZS4Fmh_Xv3+t>si7fd6BO#CU@F0b_oLrtG?t1=;ScTR#Xx#h&#-R;Oz zw(QmBOgD0dyR5Q;)1Hr~vYXa%`O_CsV51G(8YwK#SD7;J?emh9fgn~xdLq-;7GX|n z_uY=QS~-b!d@3qt0tM;TRkbnIUHmovJLdIe+brQMkq#g=t;yyfa89H>WD4`09#D#5;6uY>_gRVEw~iBgQ#0D^EzNS!PAxBCj|(Q94W5 zs~1yuiQn?pRUx(Y($h26t+1-iS*Cd@%tP>g{?pbGu9QO+Q2!k+&7sKL9uBm}Jtcj# z$*WBrb-J-}d~p#kC0fK`W@hlXfZ`brpZVVW_iY+?5N&$#xh#(pvG+UB7G=)1KDZ&w z9ycFbu7zdtl65fC0qFbdlA+q%DF;4PXPy=9OQpAz|mdCWI4ay9mmPGx~;Z- zS7xYb{!=NfjcAqR8HRP;)H%mqj|^AlT}mm-7+RA#ja4g_JXSr6!Ec1yDQuJUZ8|+s73?5 zB$$tr?Yr&k6<&5xEtE1?>nD%hsZ_U|lP}F`z%QSL{3|eDqu^1N<($CfQR=uK)!_lT z_p7>FDieXNv!JzWx64nYoJzi=bNi+Y-Fn}5uqQ~+HEqY_GgiAp4&IV_%^&Mf#di+S zk67AbG6%eS{W(l$O=i`eGLiKF2b`FrWi_(|L(x1-M_Rvx%;}VOC`0ncob!dB z=4BdONh=K^t}uOv)xy3Xv>)S|)1-Did~+;;TO`F21;r8*yg}9P?Gz-I;+Ni%QrDgP zsJs9q|F!D^O}kKFx%nowqG!Kf`1IX|9qm-#ZeGcs$v_{-&w*i6mFb2pv)S9E#ouhJ zw2@^Zcs$~7RYZ(Czlc3JI&uw4N(-_b_7E6Rr?P^}kwKhIZAD$aS%;w;%q`9CVuuwB zsRuv2W#$?m#H7p>mZFO_rB?-hl_htN!yNC)a9oY+|Res-GW4U+U>?=rOej-lY8ygH_pzX?*C{&)UuX0*Y6fJy1dQuku z+!PD{GJ?4-EMBId39QV@WMS@tW`KR=R7!wBWlB*A)E>~uQv530{)5w%Y8Zl^%cR-^5l5zN0L$XEDNQEX@Q>GL6x>PZ81kG zL3FsT3OZk#lCqV!jFrA`_+5rT!JErO1)Y@K=C+eFpK+Gg#Lwy=#G_d@r)~m?-z2<9 zwweV2z>4*8?zHqwv2gGuiTdA35_HTZu5m4ZX%EzmgsiYhAAQu`c2(33=fZ$Z$pJi5 zMYMi^221FW^ydq-uqYu-5>G0rl+9w^65vezK9rOh-xjN6A~xSHm?5m8*}|`yo{#FHJ!PztLDx5%AkLnsbTR7S-|~U-knqH zEY%T={i_8gqQHs>gY z*S@b(>9J8Zm-Rsqdi3XO@Td0IdJ5JxihDykd1ynHf2_F{Go%B;7g&XZ+q)x>ajsz+ z)$Y=ShV68FPNb@B6UuTkPqW1>tyE3fC)rQ4Vk7IPpCp*mSTD4IvX9&FnTsp}Qal~J z#?hb@@_Ax(F-Cie?1D$`VH>@yUG!&NtLuzf907el#0CT4jakeEi{%6%BV?=zP^e#` zIX@>8r8sjAd9=5%S6Rhf&#udnP8f|2Id-{vO-!9p$}xx|sCv8JrXK}=B~Pr2J!6KZXr42G4{nOy#w|VDO`h7i&~;GYP{h}t@-l86SJUn z%y^H`Jn#A1vg8%rp&tfj@(~t(yG?ZxpyLpV?`)3t#qC(R%?0Mt0IrH6-fEH4uF37u z`f$U$_fge~KAys(yXdA_v6M?fAPXYATKq<;H4_r?(*RpNIEZp{g(_4{bD%C=5cg1k z6BH*1&1N)?^!D}@Io{*|mR3U8>$r0`5ATY6mXuW^Y(N?o0gZZ$x8k}(u-Tcxn}L(`22T*VlOHlN267Hh2hl;>ypu1WR> zBkbo^H+FYML$BZaSLf?~y}iU_IDTZWF2jYAgJ@I`wi_SYF&-A8Ilm3rhS(n&FoxGl zA>W8+GiNk%W?=FJ2r{TuK94L>D5PV9ORvUO3)p#C#Kv8&iC4d1KFNw}D4XY{+_jRt zIqZFLML;)9mJS{Nz&Avhz9(R>-P)9yWnxCTrG!qt+K(}?7?6!6*X;MZX`z>a9W6f(Qj@^9KY>6@4VGT{CF zBR`?CnIDnZE5@aKaWog%KQl#e&t-G$Is4hw0Se=IRW{~Cx1Q!nvfRJ%4CKFca zPA(D+v{*zoS)7Hnc470FnwIbTNAbSDHYVVg<85BWUiB3ONF-iwdug z&~2nv%nk=mfc5hTgzG|E-cr6=vomdK5!c$yW=_&tGlv%>*>Y2aT1BP!S^gml;mym! z1M!@&$ESmMHYj_@s=0p`g~r`77etKd%RBKnFm%mThjH>55bzNX#8H_4ZgM+e_-ZsC z@up_rryf(QKDG^gM;wh}j;kwMLz-TSU9Y5%V4sH|v2cMd`8gAP;n}TSf|WQ$785)b zA=j5baG)AcXlJzsf~daP{!zouTkd-MWn9yMF?u1p%!2GvBufJ{UQ1y3hO&Mo&(k*W z=kWJk`O&jLI9T`@^WYotXL`!nU%G>CS*j}=cbG9GRw}gz%7$LN1>MFrkNi})ysJEA z@we47DvD^0zgz1%Igv^v%i8B3^|U%(7t~CyNMt5}XXtDD_7P_*o$%zu@@iv{U223^ z4tk0kr~CT$;FCo8x?{&l8CemnJLhU|FcNKqmX~(OryL1uVT?#QJl5~EA|auzA=f?n zgFgXW{2M}K$SQ!m*!@V^aZJG2QiF);gnoOzu56Smg@+*D)bhGwD_oFw=bNs6VU?uI z(Nrnr#-MC`fG3TZZ%^0=6`~=?s^Mp;kw343Yf$SnRcgL(rmUbb{Y`H}Mb%hj zn7~Ov_RPk)@zl&DK5yDAmr*12C^b$*_fi%0LyX9D!N@bJ(wf=}a-|a#yWFy~<6cV^ zjqRO=biveb(tz5R^n@0at01*}3y_=jb@8Rxe_J4>8p!W#wMUe z{%Os`?LIfv`P=)UuVByok#3VU>lBsTY9g%5^QQat%xg!D5$n1L3I_=v8IGt0BixH- z5_O^8Hu&prkFfZE-WPD+>aUoZQr#j1!kYfpaQcnjt3{}Lq>JfGMr9C*%W+$gPls|25j2UCshq;7N+)Jquwb5q$FmLWCI-)_G@aSNVivMq9%a7ixxt7^6ROfS_xl#b zcOy>KK(h#-dx?j+9E)lGE0IK?h9nmuM`CZAGS6S-)_4+?zPdkr0luXb^fvEYOjFuy zl$R=Zact*=SEV=(e1t9gT1ItV-S#g`PV)1=$--@o=#m+HB(KnUQP#Dek93EJYL~3@ z@*;T3tRvsAmxPi`+6|95rC7HQ6z}P2_;+x&vaS}}h441}6%BlG2=Wn7oaTIXx zRv%|K;rLn~fd(BvDHammH!>qZQ0=$ryZx_3ZsYq09l^SMQM~~#OWp?+TOy4U)6C7J zd3FBp2zM1X{?X*qk(SdVGn3 zi4_YF+2_8t^Ajq}{%Upg<@9QmF59#C_5q8okMXm+i>+a{(LdPV&ZNxh$lPAeiARQe z)!6jbx=#gP{kVjyhOJnn`i(?4*74t)3{2*lhK?ves2oWdrEH9st*8&1`EVzMj4mT{ zaJfuLms{WUct#qexWY(~Bl?;OgDk7KQpNAeiwo#geczgs(6I<*?*}Q0iw?2lCZ#+Z^j!Ik1PX(Gc5jOY#_K$e;ZRodCsIplRtudsI3Nv{ay3i~CW;gGfaNI4| zK#1qTOyK@@w^FyvG%?tZE%|YKjIZlhr~VT{NpjY-Y3Ak9J{h-8n@-|aIs$ZdmgnIc zSlWcfbDR4T`)zM>d40|C3d=jnG?^)fj@|lTlYpJCbJ#9uKRA%YF48y$FT1nmDqA!-=B4+ezaC^1i2{j`(K(Rz`Yg zPIph2p!KsiZ(2je|2Kps_RJ9fs}eHQcFCVy#>m&QkRkiC97rFX=3v9g^g$aAx+au) zN=NV^g`dcdGnZpQ2C(tM3%uI(H>NE&ns@nj=}I%{Zr8GKY!zPNxA5uGnSD0?vDZIz zVs633J(0vz0=mKnJ->!e2-}5*m8frHEJ$8Z{&N3&N;gbltx|>>CO)Jm(VS`$nCTyR zO@G8djO7kn9B2I5l!6|Q_CQK@-#F?x$y7PYx`TVrdfI4HO?wiV#7M|MvrFb1XiJnW z9oE~>XF5Xn=v-??UBf^T4h^IFphgK?EK#e5$cDT3(tqx1sH`-?O*1|g3zxxow3~AMDD6rKE(y>s?or;(aP- z=8&-{^U(Qs*{b^pM`wM-ydX61Sk`XMA~?(85b!m+*v<_k(VuH;LR zug)Ru;@Yf{q5nzKEbZ`iYTavLpG4T!-3wwG+tw*ZGnu?>P#r(qci%5ky45B=GD%E? zvN?56Rlbj4SNjj_8{t*Iu4bqc?MV~GwYfv(|BZvy^@bpY1BUCoaA7=aBd7WshO(_z zZ5dbi^Cq@O!WG$*Zp|kv^1=~qU8Q7bMXM&w`=wJtT22OvaEq>6;TsOh%OFqC;QGWW zDHYJ0wdnkCNWR4?swimal%PuA<;3+MJ31olllq)M$g=Mahsz=j33#3rtwh~4ger#^ zUo%TP4f#|@kXGC^`M0R#BQecxKdBTiqdxf8iBYSiR`qBIxwbmo+ZiF2XQ!>Kd2YAs z{SO4zxvXV~(o^ThgSS9=iM38~%oVcwcoWT?Zg;8cD+YEf*n-GLn8Vc>OYyN?kj3uw zF`9*XQCAbhD>J*}kM=)cOK6yUPa#_pUG>>%yryZPR@?ZX|bh$A|Pg| z(%qW;MI1Y+*SMNl)Lu@)Z52nJW(}=Cmey4@8y`K+kDMEim@(C2*Sks!?P93h_uZMs z?rP$W-%ct(jd-omJgBXYWbH7OjY;c0{Ev8O(;1IAM)vrUds8&_=w0*vK9gL5(DRF- zUSMrW@9sH{M9r$ayPo6$V~BnqLM=z?j1Lvzw_O$Nh@xiHShdT<`x;e4Lj#?zZ{nRD z8z;Mm8@Ww{U!2LE4QUOl^KZ}c%M^;KTSGyGIFJTvz7dt4L?3kjr#Vi$LCU110U4jib)ki@ zQtkg7&R*@#`zs%#{WadM4igH#8H8MXpwc|n zpnP>o4?%QQtu?C~9#_=7`t^$7Y-r1IUB@>tS@lacN1Vzc938zqM1R5JQf&9&n$H`S z+)Ze>cugV$BVDaYJc5A9k%G#6P}+N8$#Wq?H}PNO&)l-_fKHvzE%d=UZxVMu*zku* zrBMOL(bSFyyyyu5nUdyf_7<_6j7HRBi1pOQs+r_Ldo1ccW8kaF@Ose@3|iJADUvI{ z$$cTOG+>@{SHZ@Ky>-jlow)-w@BE7l9K(Ku-y^~NI|8O zmMuF!T}{%>>c-XK&=NUIv349#eeqa;P+;D^&@7eSbus|W8ZKPXH@ zt&xVyr=!Fc?3$dU1I|Ma!d4h~*%>_`7R8I*B@-}5EQ0^4rF^w`2t+{jhHeVX_vTVGDUz!QZ^srowMuulDN z6H=H?)i!f($${Kg*AJl#MWC{}x_|nRQng9{wa`cNFbDDyDQAtsQ9Fa?C5nlA>=03udZYgL> zyBvSValb}|ohY5?gcnconMa)>62d$9%Qi%lZt2MDGRXWaYulO37Kgt<{s3EC&Z3n= zZDq(iiB6_yqd?&qfiF4?%oswUJQmAtLQ6K3ugjq<{W7tN`aoICm{dmtp$Fr%gzUbF z9VXppiYlV=&xy#m;s+AgrnAV?TDm+Wju7Xhoq2JOg-Hvdd4_)=fSTv4dhH^|$^Xh} zi(Las)02r=M&r2TESkz_eN(7iQfXIt2%~pDheTiho;b;K73fr5-TV2UByp68_sr7^ zQ89I}YPXZBd`IUxVUa8eH&tsUxy!5-Taivk{Vd9iEq5eYaVi-9bXUUyPB&6sMk7oo zw>LAx4p7}Tn!`mGL)eZ=Rl;QWmgi$kU!yswA6w? z=qJEfR4%vpF)FNp3o;=}Az1=OdA{3Q5poWRVtND1_F>bul-^RZZTI zUBG)jI#cP8JXq**Cud;ZuaP=yxF_;zIMQ(H%I-$PJUEM~su`-W3#4j`L;fu7N!w1k zTgIaNZN!VFcX36840ryI{Dp4&Z~kId0TcTdyXX=>Ire-i4X=BDZqNatiCtu} zwJ4$|v*^pu|C7sAMAE{tDsjrBwE+Tm3<B_Dx&1uDa=FczL9A{)m_$-C}K)Q$> zx=$fTCm;7yPnR|1oJD;co(1hk+c>E|8D>0SicS40jFd)6CgR}5lcpWu@3VST5MB?P z9D%lXO!fzrGzKc?skhel{U@VrNo{~;l=OmaHrdZkKrN{@3rKsrx~Co7ud?b=DofT{ zqi>EPtU{=zhRN~&lq`G5W;^N=I@5EwG(hiLe*=jR6aqoKziZAS6^2Md6b z&{VtN|=pNl3#u zpMB>^1+*=~+11;iv9pI>?KrB!cKlQ;4YbJE3^$+*`(pUhc{E?{w9*z~h^+mHY=w4= ztx~@-{)dRY>A^$A+}L;;_1T5>JO4S>-7|wPT%U|xJaMScatAj^Q!1?eSwt?(`))0{ zix>EoQ&`#f2wlJId^}5DWw6p?q@RpBkPzHq7tWM-ay_G>4LRX(4wLFR{u;=hl5(p<+~xnisU_STVb2 z>0CatnC_VAOe9;ZlbYq7rUM)+C%rD``GnY67P)sfezHVR20EABJ6Wn8yo)of@ET8N zt<3Uf6xE+*`sk+=x# z6lyJoLrm7Sv2)E18Mh&REM?;8;RLlDHpG=M0sz2H1H|p2v?J4Z>1LqI=9p&;vx!YF zukW*(RqVyfzlZVX%jMN5=BN}s4naJ#rbyD&BY&UFe8Fd?AOucjmLYiCT+K`fdEQ4# zPOG0HtCV=L*5~rTD!(NBw>f645F-Kh5H2`922OE+H5%w z`kfUhO7i`BUfDzQn2NzvFg3}addlvu~df= zM|dh^Ba$IfZDDeI*HX8O>SFSH#rq{L%?eT452Le%Awe^+-S2Aj$KuaK$rQR#Kq*GL z-3kY58$6C>OkAyS_X67B67w9XGh|BdnovqiGjf}jFg5J?@V*kP=A_6+{Y{lz#$^fx zv6r>r5sgJ{q!_sjoaI=OdFKVeP^KR4(Vpd1np3%%GG%jJ33Yv^5kb@a+pMwMW;M#Q z`j&?_VerDcRG$4IiDD2|d@c!@fGzsqjT@8Qtp!50L7`M6sj$y_Tq*Wp>JowcO)&t6 z&9?Q&__c(*!lTRa%7tTK%$U(?8L+#IT3IeppuR^N_@JkqI0Xlzt* zKvwvre7Oj#ae2{~yJx(4=n1P@Gs-mo`rK#;x z{U86D?7p=Im#OZY#|I?QV?QytC3DEGWn$# zk<3JnHa}*mnoyj&yxdB?zd`QI@n=g*Z~l$3q~yvumgb{7PQ)lq$rq}P0LO#()|rU( z{<6`Cf#2+xc9I}MGrUKUU=3;45S?=BYtW|Iu!9H1i+65t1)FF-*Me=EL6%{j|?ERXbBwCh^`WZQ_xX$i6#R=iC45b4&yJsQgoXjb(g~eVr z;<+j4c_hg4N>&u*OpN;Np_-8p@vW75(R3#1?RQ%MLD3V`x>k0FiREO+FTZ=D=-t3WxUIN23UptQaXF}V}cY4qOxADF2H%Y(G#bfR^-`xPoc zE?nudj64RPBRR>joAho*9NOWTixh+VU9nG>KBa{7)(E&ua#WjQa+JaWPKmlyvGM+A zDUWJRTTxxb2jy_nx67j*l@S?+uz-flRT_3iq5g8oqtF~x9A#(?qRKR1%K1VkJz<#- zPqqIgVq^Yh-PaUdl>1-{F9iWs+Z;4Q`JIUZFRFGJdnCEMSRmJ#q;j_HTILf!g`3@y zo#e)_?-2Mm%6`UIoYd4XJet9X3{`S03P%@In-hdt@AN}AI!cqu@fhZQwYFa=w7c)R zh8?~|j;QEphIk5g{almlZ0;8lk_^`wJ}A#Ig&c7o7IWdBxedRqiDOE;x!)LuIV*qn z`LxPxQ>Og}>^royL@ynOhJvV0$HYHZ-@(UT7)(XE0faxt?;nX+ZJ^|rAHeSYET%PshE;q^pEvGZGKk;+W_M!# z@|C;9!m_@w_V6PHL+sGgyV2|`)haelqF?p>5x>dON?nSv)(3JZ2>W!+k*YuK%}`{~ zZ*^9+&tV|_B)_yfytQSF;gOfU%&}{*ohXFQ#Z<2 zT!Hs&*REI7(qc`8wVW7?pVq~%c}CVsVUh@ex%9@ebv2PxtZ%?g-9^eEcO zHTtAq5l<3*dg_i%wShLBZ8Ps^@U%{h94FmW;&+^YQMEU+U@J&=hDxLIRApJJ=If{I z>7}U{Jl;Q+q@UOP@bS$)J}%z~O*e=_g-A{M@; zck*H8o;T9NT6z-!E!^{S(*9&q(-=X&YB@;VEbZy(8U2}(nbL+ZuX~FE^FoxDx^~&8 zJ^mqndR+)?{G7jOZ3bRn@|+>XABz_SGM1Vez;yhU=mF_lW$5XfNzjhFjcw1GZBWSR z8QJKRl6#`)dER5e$*Wp`=fKmY^O}9Y{_a-8>JQ-SP<`1U!e#3iTeU;EYz|80ASN#K znhDG7SeGI<$Ew?3j)D3GjQS27M`4`IYN;vQWo=M%MRKh#uQQ9qkUn9aSW#x~Ene`w z)Gm}pempvT`D@p3cH&1^+|m7lk0^YWkq}`Dt;8CPyvjl>lsK518~hY^^sZmZK-G?QOp3h}knwLK~itsr}QDPL$xIIX-5%+}V$0bUX#$#`wKMq?pW zM?8muK43g@53WQ+plJG|bhgL2-`ad;TYFXb6{(Qm5m-Hp=D=bf?BDfg-ojW3QGcb} zOj?zDS#!eReMdsUmp@g+WY;ul_#+H0Dw@~F%OCcoMO6R9{Gimghtkr7&Ho;=$^(xMkfaK0p?Ph-y9(Ijpl1EBByrQr|$n#}VPTqlhqJMXY#0K!K0*a{T@|E$3xJ+-D6`YY4sz3#jDpPRR|w;pTlLD~ zN}sv`4H6b;HE~pgXijhz+}<)|0=@d3lA8^t6FSUfo-05adO89nSF;j3;VAjGX&a-J zzP`8QRI113pa5~!Q>5H>kDkM#zV(%D#0V;^cv$`6a7iqE>}U+)pWa>>suU!$reT74 z2tQyNSwA{2VjYoV6DfJI?t;O`!W=;ZwgzN30#99uGR(Vmu>yU^5JU;eRD?F+UTMl- zk&`Jgd%D4zSzFT$xg4d@k|u{MGM{5%VKmW!4D=+82NgVmqB9~#cL=vW9p_d0!11}e zBtXbicfCsFAfoGY0!V5qH!>awbO_jSVaL3K#cJ5QVJOxeZF^RNljNAXBs+b`abBp? zHu%~zJj($@unP8H;qBYUs~Bx$0UbB+-40Z}Y6q$~mTPO3NBwYkIqqw1(n}Y8P+5Qy zo??TiFp1D_+(859{ajPYi~P+?^-g|{nn!yhR$>Pzz?C|OnTs#NuaS#B#RHx7GNd3e&KZ^R7{_sdp@mtGSIE?-bMcBCuym%<~5iH5r=&>G&;w2csZmM8a**z3VGD zV5;#0(ceS#M@~tQs8t3w4u^h_5eX2+?BwR^6kB$_ww_Ss1L{c%)&){1`r{a97JFOH`{& zi18&&M3l?Oi+?vlrr~b5FL3J}t_(|JhK2{^0ArwuyB?BsW_XVI9Tv+TBYTucK`c46^eq*j z3_|jKYzn>4;~>#P+1)(~Z`G}s1Y8!YYcG3qb9QdB0{YQ`0f5rfvC6wZ^Ic(x2b{2# zy@34W=d3MYNH}AmXySM*iZpiAC^-TL%|ROmpAKRjCabhe7@RS${R2%V(q3D4f_?;> z{8{cwwljqv^N?~0U62q$*tSV9*5MTdJPPw!8L->wHx(`b4?N!wFP=nYLR{Z4`E>aZ z&P5#}TVqk7j8jW9nFi~;sjqyot`oVVvzujrqBa1t(B5lrd_Ygg)V5X24l?~ zn?kUKMPPC1(v_nk!R0Ix*c{oPxz@+zRj7M8*UjHyU4KM5ruUn(oUX~0Pwu)k2?MHT*__DtqW+zlmI;sioS#Q1(3rdYj0EJsq_CpQ-`WIlHI5r{V)^}J5u+$Fl~ z+SjjirQS;z=dl~AAnG0?ORqLCoaF9Hxs5hdvEU;xruCteXMok3MVJ_vq|ea}z$?Lz z-ajUa@#1wl)7~by@LI-MNGDFmiy=p_lpD$zq`Y>rKAXYp2s|LX6#jISMF}vIp~h8S z`bf#>?jTI=2fD>#5DlYi`2b{2|H@C?!9E=7l=%f|-lb0}+4|f;yLB%Oly$%7ty?#rGCYT1h zw^Qy*$EGD8sUB&6T$$~oU`X7p3^pI9Ow3~HdqI)F;v^$2O-qv@&BAK>3`6Y?cayP{ zd*3u99r7{^cR)DD&U7O9Lmi$q%0^3^dHZL2J%KWS)Uigp6a=Js+;#fSrh^8t+Dt2t zMs=qUACffVFM<^2W0^L$wVd+CQYx|7LzY;`aF#8@xB;mahtDmBP;?_>S$1{c5H$ zyI0kVaf(T{VW4S6Bgv~XB}Qf>ATCeCDSY?sa4%KY^Ail0bXO=$A!cH)4Bd}9i!gZ? zY%(L;FIK{PjjnBjH18jU&Cpq|{D>dgBxK6@5TeHuE1Lz6*RhLaYEo#jBC&U_*&THu zk6`a4XIgB`ydRQfwoy2s29x-Ny#uDun@GDj0`alY+b-0YL6JVwwIq8rJSNbf+~~Su zW?N0`C+06Iw#c`DKGob>o=7UHZe-V9EVESthM0O>9}>6sVK<|>lyYYJnR!Q-BFJ6lpl9T3{sJ%`87+^VIOtrkQmv6-{kbe-{y1uAoNED-s7;yc zy$vGC+Xisc2vkb`5so^|mXeYbRcbH#z=nrF$0ZQ%8+`Px*|ay6a0)hpO`N#NmLguZ zOO1(7#Xus4PKHQaG`UjcLRkRM=k!vgy-;jB2y{FUgt@ z4hq8XJgY<@D>8$e8OfbgwN58ErxHm>^F{?oQZe(E=``6`RJSw5?wpu;x34jx=KOZb zQ2{k$1=6{DZ$2vkhksH-%(zNs^gyF7SyUyrobh}k2|%482{iV*Xw=iE#6g+<;}|S5%M~-Gc)Fym*3v^l zf}+Hmgt)AHEhlg2WlmkU9TjmGNA>|Ziztg|z;9;XBg_;>%$M7)W^4siD|3%}(_5by z!iuJx#7l@QI6m->bl59;(Cd*X181;*HgZ~&alMiB1|?RDoB5M1zkADpz>dzRXJ==1 zoyq1!K+JW_uY!hEy->@V%7?Noj~Uyl+VV=-4VOislmnM!jL|fZexvz`*?Qp7RmMC4 zdYn5-)=33p^k6HPau0c!x=*9Qwmi%-0=`Oo-D6kKR=w)mm)PO(v$J=$4=8OBp#f_8 zh^hEdFAk;Q#Fn}I$)h(a>gq~Y^)f5?N<~V+*F8twjvI4xH`7aM1^mP)Kzq9Im-$R9 zE`@hUhg3@Ji_TvwG3fQw75okWh`?%l5-m2kdR^KLB;V? zgmnkZ7+8MJyRJa5I#OI#gU#&rjLNPbsqJFvvFt%!-9Ez9*?W(XOu=a?CR&Vm3hC~! z8CtCX;wxX$#vwggi5Jb<_9d4)a}GSmfU~>@3CE?xxd^-uyrNj!itn*C56xZir=Nt{ z!R-xE)0!n0=_F?goBPA1LV}hiFW>zA+l$jq>@1Q%!4Gj(Cn{qJLEt7k{8EwXRUf!t zSg!MOCchlHqo}T-)b2o@m)2~9clb^xUmSxKzek0Q_}v^*@k?;>R$^1-K+b+MWo8JH zXG3uCVb;i4A+^mW@-vPyvPr|>el+x<#FYwZ+1N&G<$^mne8TPh!zJL>fb z@lb$p+m4Ahi}rG9f?X$A*3&TaMfkhGdt&f_i|V^W?aW3DM;l_|+VT=-w%diT^$PG_ zb-q0YM*8hFGSpz8u()P8E5$#wI%_C5@KKZmUjT%4 zz8-)6>|1-0Snwrwc5j9%A;cShOh?$MIk>s*6+x~VeEa5*3FyeIS7?Do;{LQV*|$B% z(P50;)}Feb^oP}VEn2p|uk{>FnY)sBC<@g5HIt#MnbXddBK7W1=FWZac zP_mNA?~(lII1Onr8ebbhdBC9`F`qAtWTl@e{3_yB5403$^KOGOes_Yb_M=v;hkSG2 zzQHHD_%WAEVYR*6J&y8O=K#lk{iNm6`e}q&z*L+8(JLEY%KV#G!|CARwO3VbtXYj;ov+yDKrr@bVkDHnP(oktD3tXew;7R}@3YI>#;m#g&RyJkC-h2f^+6wAS= zv6Ie0|0nq3g<9*14o8Dq+(FLW&SdfOs2Xj}GVJ{K|JE3)>1GA;xoNamxc1qc47ege z#Tr@~<*YN&fWO2B`&5Hz0Umx5iNyG3CSLISltPMs1&xwiAuM|$u^XwVk zRYRHrV1en$u8TL_@Q{C;jV{{-OeohWZg1NslINyVB}J>yvj^no=1nyAQo#Q$zkSqf z1qC;fwB?`OxV*n$)eF?=-ShOTgUs~I#Nc-v>{YnQv-or=1Q$%GyvnrXLDY@#Z0@*e zur>{a+7HWImrm6q^(_?J>Qxw02MXyTfN^V*_E7LpPjhPZf#d<0K>xkTFN4$V*HIa; zN=LO8)t&s35PzRIHWjW|lNK+DQ?SnWORcVMRXU}=tNLVix-xcK1(AG^Dns&afLz=$ zh9Q&mj1P?AJ0*hMKBbPA6>D}0`pnF6`IcS>=Wk~}FjUKKOM{THY=3La@{e|0AT)>f({2lJlTE(RG@;C*m)X<#Yd!>)eBt#@l zci!sLxl{Qm?N4f5WYZZw^S3JWaRZEnZM{{XB(FT*c+!^Du!ShA%N*?d$4y)4YJyDA^g((1Dfzyg~O=*tU;X zJs{9~~%wB`_i)*ITw6QOQ&QQORpTzQ}jX3zj zZ#a|0ez6<3McAq@49Vr!&^9&H%w1VN6}nQ5M}kI?{tsB_?o#Y(6$kem(G`$(+mTI$iJ3!}tBycdApQXUJd-pC zw=Rh}S4L~4z!mfyClcoz7b`{bE!iV(Zhw~t-27fnwr5im$JohF1k-9rz%WIxEEUea z)rJKNlh%VD(?PB1{&DsEZykTz%!MIVKq!PHQGqd$L7wkaDG=XP76AU3x2R)euHDhD zebh`sV(S@Ndgrt+^9yu8{2wg9MYddFks5VLSpeZbu!iu9rSsu-S=V}96BK;FM2=bg@!T~5h|{;L;$>{+rpZvKMi~Au zpDvN07Bx|6?O4J8Vz5FnmBBj;7&yGe#l;zuqA+xzZlf@A+x!@6)i$sP+bRG~h;-8C zW;)x$wx>?Z43Br+@j{~+rNH&h?RVv zj*XZmiG`%hT^%SGv5*m?;UmD3Ox-WG$wC{MO%g?Ins1FVIr3p0shp*@>)Y?24IBJ( zx23B>7u&q#bVAh*V)d3&eSV;Z-_UjfHP*l^iprWQtc6Lc9MjAixH??P8 z)DukB)-vVI|C&`=8N<0XQ}v5^rv?4u8&z-;E*|bOi21rHww1Fq&I)EY?tL6ZqQ1I{ zk)ysYd%%YeMz;B8{r$c^R1~aq-#ZITlnDBVb@2EAq{IZ7Je>AE5FKW2EbRtR?ZPl_ zl5_g)yLI4)0vBguBhCS=WX@{ z!19~Ds;yawIQN2>6Fq^2s-uNJn5g)kjV&<=i`$`@Ux&oEL2UKCuzF?}%tJENWsSh) zl{ike{=nS6O<%C4eI6NT<4nE!z^ztX6lzS1Y1XG7lNVWdocPAk+r<|_LoqQ}&LbEz zY27buW=+y2M*bH2rHc;jryzEFAJJmW$Ml4en`BZC;c+<1dVsJ%1w$NhETEObUg=x( zo}5kt3}V+xO`Iu2;MYKyLck!mb$KW zdi1NGnPSk$p($%mbrEd-$nr_p8AiFAZl>8;KCIHHHNc#GuB~smp^v5wF+N`Qt2Q$k zm5hM5Cg0?NjP=VLWthIiag;(a=agt=bNq<7{s3tt01F#Ss@taFkmrIJc?icRnsF5` z9h%$8P+}6gxSUWn3b66S(rZx+CzoysVd*&6Pkr>CczF2h-nsmvbf=uoNeMQVtMzns z|E%iD;aG+2M4k`SiLq*C$uBLbkFI68>%zlZ#V*Ca7mT~ci@v_$fews_D8$V3=k7tA z)IGcU%o8c})&S@bwTRbvy^`> z_UA!KQTWnY4Bxo-tOG1yzlp0Iss5Xi@Oe+WTvf_5WOldf)UeiR4*mr`>zp>Ac3!`(%36aOVcd{*8gdw&S}*Hq z%lYX%OEbubDf#QdMka(}$itM}N?%v~2Qw~RtF^W8%mzME=?|g*p0O}D(~fbmkjs-CwrQi0R3=oPOYm6h2X>-tGLy zDixiZT{Iv8+5X?54dxxn8Z8HjtJb$1_leTg}7BtuM_6Hyv82tfAt2gim zI0jIEkJR}#6lb&U@A-d@CMJ&^{;lf4JQBxgJme=flPuP00Vy%}$G z05Nz$7OSyRP4wLBYmV-Ni2#iNi{y-hjKT;ZA4%b24!%?ZH{{*=bhU(o?82Z5NshS&-YeJg%;u(&8MH zRF2!s9)Ic^Mkg2TyDGoL-pqXvB-zn973AS^X!Fs*^!G8`+zRxHUiqgV~Cy{k^I&Wh^Ion`eS&q1gfTA4NjzHrag`TWJ@>odj!&M^4*ap8lEEDr3Nc0~hI zO1=q3BL&{ye-Kh1y^F1=>*O5UE@R3K=qn4HA;s!L6FrM$wVs{V#PZ4hi2sT1Q`8hS-f9aTYsk-+k@^aY?;;?n zDp3JCW>FoU0Xfko62~;`8JTK;r3FpVr}fh&%op4qb2!RNB$&E-^q>|6s-HJj0Bhx3 z(z4}f&siB&v0M@9M`99c4?N>XNWjawlQ2IxmzOe2jX{vU3Pj+OlWdk zjk0aimbN@g-S3O530Rl#7+d|hHIxBa`crSCN-jR8(OS)LB0RTfb~wfEiZV?71<0fHfnCk_S$a49%9*uv|R)Rg=Fj$Yxe27^qfVuX5mN z6DwGMr3%pRss4NAd+5xeW+2q`PcLtlWr$81+s~S?xCc~U=adh$8fx`3@`nn|M_-}M zgXmc{86XO5D$AgAy-kc9n^`K<9&!m2aa(2UzhKHFPE zX2{+45b%LJl@XNVEG9g~c13Vi+kgn0bU zTh*!~wv2w6cTr>LsSOL2<#vtJ?GqNIi6mIqb>3<$xn9G|YgoK89mtuQ|9L<$MoEhw z$1S2FdQZBmlh3UkImwKqkkcVKKT_Hmm^WX$Y*hANH^F8$n2Q7n(4|TSZ)HL&EMPA- z5lOb<|B2rxnbNx%T)dVfTm??b`Z#N}*m&0)gKuK8LBN7v{?C9wW z4oAi79}_e=g*$h3)Qx&J;+clh-V zZjl`#*eoF$v#eGBP0FKAxf~rz!p-!VXLQ61R7SC1KAlCKka%(`NAuM?#)=N-DM{L< zK_l7>?tIGl#Et{1ki>_ubptW%SR|I>^dE0w8Z=Mbd_bEk0PnwW+Kr)uXup}p9lU6Tkg>cr7lONSc@oc!KDz1(Ieg;OD<^!5x4 zthG$y>t0`+In+q2jdX~SJZXU&lM_*0q<&q+Whxf**f+suopBT$R3plRRRPame`HM% zQZn+TjoO3+m2{R~Lc3QW8Izg6xi&U34?F+eDX@Rp_x}*X-!#BpveAZuuW% zSQ+`A$3lkVeY*_*rLWgRqsr9ORLe&1hl`i3$ElVr{|D$8W#--J>Dupq!cmE9e17dj z{JVPbZiLwH9pB5B{T$CtK(r)vqRcF1kAo#KpJVu64OD1=^yOhI@b#kOa>qNs_$xU} zu#}BJvRtu{=f!60HRHeE$YAT>V9?;R~y&v_>cFP6!C1u}Vi?zCSMIONx>lel|8@D@wuZLWL7pMi%I660c z(_O!FG`M~DM)fYe>eD3;;}g;s7Z*mMg6+Z%R=D5%e(&Bq?BqXp@myfOuKQVJa;K3zz zDs-kwZq3bPgl^!U<670WYSRu8Gyp%ZCcD@Bc+s`lC8069<)$jzf_WUl;BWSwrjs{* zdqfw|VSs;@;%W>%6&$O|G?ZAl@Qwt3sk#UZlZKio%9|mELBpT9P+u-r7ncv5&nv>O zzi+8!4ZZhM>4p4GI(Vwtww#B#3QNM>`PT2yTdEf3P>udf@u96>ub>G<5EtF4{i zlZjhQn<+72tvq~TBz8Cds>oB7SWJA`^;((dP{nH#MquLh5a@Rsgbycw8MvddPI9<; z-BZ2wyOC7Ge}7QxwLHia&F|rxZ{V>0eTY_GdvB=pR-j4CZX;jS9GtJm?_FU0E4b^7 z{NnpVxb*Mqjo06^kng85EYPh&-u<{}rwM{+G)^2P=6wHkoE&&|)nRXuj=m;Vnw48iMDA;(t%*VV1p{_|6! zO6JkfhC=v&=R#lrqy1*^fd9sMD?<(^Z)(a|>1)rL(EUoOD2kw;b^i@z$Zpv*eiqNG z%mYZh({3SWMqjm3b$1;q_aBvzzO0#nMdumlWWDXyxTbQrFx?l3RkeKB08AQ3R1I(T z3DFlGk$@1s*;aFdZj;?j1z1t(>gsBv-@EvY=2wI<0+P)5O`d+gI^uFwf9~G4q)^VM z@>Tg+KIE;szuqiNL&wx3g%?|^-?i%nXje;lid=p7IOmBMc}TWXC|@On+aV`bL~?PW zsN^!ZOVvvXR9Rg9J?_f%J*sK63=s&*drg1#ja$E!V;kH0#Wt+~RVCv}S!z1D-SRFU zbDP!*@G-Y#NV9XSM-Za~=+!)pd9K5MdSP%aC>?g_W5BT_ZuWt)0fmg3uJg$L+z9Ia z>WhMKsM*l%BOa33iY@%|JqBo?+^&SsdZ}4d}D{%&onjc0{P0=C^QJm zGQv)x?}M4=Z-`yt8q@b%EXRkrnhp!I;|ugQIN@If{ktcJ>k$DaAE#x z>~!_nNwr9OBx$3===nBi^Mhw!tmYiQ{nPoShv$mC?-?`N6b{n+u(DANs&SU-v-bU; zF>7;bECRUMv1IGBkR9zYQ6fMrPBHs#t`;|+F5=q5rP%f2$=pzFck4rCr27NO>dOV& zpWFS_b4zIU<$eMShU7OwCqwI-ZB(F^0A73JdQr{|>wB)3&~sdhyPIY}n=41A_YaeC z)1jnZ6^pUx@c~VI2~4WXyjuH8dUDH&HLAk-fRb7KC0=f=um=w=WNRCk?WFWiGXaNM zVvJ0z44B8ou;7m#Ul9<)sBg0MN!3_6?2x`&Je@h{b^9K+2-6uLeD=05a7s%KF;61N z6ze(R*L3)=uUgwEIW=K|ynu4_e(%ZE)3;Tc#C;?vl;m zrmgF9Pb(C`=#CE0?)BKITx~m@+?WY85+@5KdEwpr?ZCL+o!PXzO55mEy0}S#%%R5o zj|$Z3>aeDddscZ7cVO@wL7*VNkjMebYL3FiQ`#Dqdtk(2-|+q$eSM_yX!1XU4=0Km z??aJ-?88D1i2ADP_xxW|>HeJCy$Y`LMZOt1+jabzrZRWJ(gG1%GkSTQYI}*H#2pG> zKz%!EVpu5j>eWM5;B$u3Fq2|o5ON=kUBlJ&+<{GU zv1Cs#B|_@4#4@0kB4M|nMsKa()_{{EvfiDl&l5N0@#ip}wve9ldxh>Pn#=80{z&~O z*jb)Ps<=-~Egyl*YbOysOeg?{iQH$Wm`y8-h>hvLvG$fhaW?O|FKmt zPH=aJ0fM``3?#wbA$Wk`7Th7YyW8L{gU$ehoO%CitzGBT{&3E&Iv=N|r|YSwySk_E z{$1Cl)ous-buBd&GETx=;`Q>qH|LGl=Sb89YvnvMU@F}gw8gdL2e~&EWO5};{4)EXyQ#XPX}Hvcg14o?|WB%2zP<*pFHA#7UEnvYA)gmwF|Ma)5jhJqlkRD$=pDMHYG>b zSyN(2fka>1CNbzb!DgHoFEaMrT9~Uxo-6bbNJ^K&?ZlXw#l!J94OlV!Or1C@ZwSoD zkfCM+YLzQu{*Vi9FMx|4pWXhpA>AQ5iS2r8cVeqk$*2(XQ|@(k2a2eDQ`p^H0T=bi z$_G2!q%O%{Fsb2kA0icg=o_n6-Akgd~6;Gv?{ zo@4xD_i|1m>T~y^T}Bh}dU9aL8cZf7FKL=!&6VtZ)AfAUC3;7PIOODFA^?z==l#iQ zW~21W)UmrE=z>+?g4gfN7zXqCv_>-=m|8#N_R3MJ2sM?Kxo_Ep9(pt_!M z@irMKTLwhvE+iY+Efycp1-#nKF!S9pH+&+$rmXIs{Iw zbLO)3^4Uk9a8(uS)Gus)T}6xtvN&a4{Zrcm%;4wfO&AXnz0eZ%9_Q3yQ>#;ib%J9- zozivZxE*O4+Ku`=ougZAW)WGDaSeX_0-tBj(H%yT3NHS3I)iP4^qY1g*?!rJ?a4B} zV^KOu19(HI>SgafhH>4ya(vtjMv*Lg-x5&)a^wZvE>FBPb}Gn0-&#cq>1pNs>qYRh zz~#x6CL!%eX8_t}-0}|4ereEDl>d2MzRuC&ig029-Xl>7ImJri?r-wc zl~}M810uxF5FzU?e~sgU&3^mNCgtkE!MV@g)X|QC`*Gp=*Rz!`ts(N9grlV1zN?c) zwLTu9DeZEqzaNUSv_W5F}kq~UQ8*Rs!&A6j-hf)`@Ui`QeA*+kTHC z|2M-jj}zy3JXmxLB_%8ta4bwZz(vezQ(3u3XAX}{a=cBs{Meg!?;sqjQ(wB`GI@SW z<};Pkk5j4bajg9%;`gzKIESl#w3SzS0J<=5H|V2;Nmx0m39eVl4Kdk`q)cP8rR+sU zcn?j3dT?ZShu+VRCRYV@I8p>BStC3}UJ0)U)vV=@$nV_!-P-z;M#Zh8P1qlbsSir) zao#-zHCfV=9sz1#Sd*|gA}lII74wFnv~f3Iar`UA$zPl_%U<8xQ?#E+f!-yzzgqSp zvJof11~k$r`#Q7_F44ChZStMak&UN^29GzZu;)A`pBL^?{Wd(i!1mh^UZ+kRkB-M! z!bKnO8RX@{r)bMB5MJH|^rD)-yum{@qS!on80N){t^{9<<-Neu;;Pzeq&uLixovrB zUcIBR=e@fQ#Pm?+)mgiQ!e5>-TcQ1IFWbW_Q+~*e>D-KZtB)_8I`*BuJJqp)J8Vvl zB_^}QkN7S9!0>h%X}!KX0pLxf63v@vvu_b@JgcbXj(^4uM-`hob`Z&~P=lgV0|@vw zNU#s3scj(SW>fO~uIXUugXr_sd7C2QTI#>N1FMY;beg+v!&Fwq!x@1}ZfC4)B(Mg! zDHrkb0Xl`}ZxFCkKd5!p=ux;8I^5-Va>onyJ}diRnVi5JR$*Ns9z~CH*7!s4dJzwa`$%Gx$bNRLFn#r;56|$!8UC zd(+ooNs7I`T3H<`x$+5 zDbi-~!idNhei%7+<|h zQ?KqQsC|#ZE?^jxPF6!3#3^sz(&$sE7fs)4$-Q^hLxDPb87mPmYhm09v|`WX-B|y1 zM1JVf-vMyfV_|}{RhPvRQ0Z$}=5UuWodLIUu>9ZfVU%-+7Ok|M^OR5fa}+(|>(5%t z>#h<(N*tm&lJ(p%S}!r}yen3>W{*eQIqOW%p&V7hGLj_cc6tWVX$~!?3YpgGsP?_W zke0b7BhS%2VhM*c!x!B#(3IfcaBhO2HH$iq<_K0JP?DabM@);q%-gKc?jg0LfeS*!e~uy3vUw3NEW1bI z>ed`j_hssh_$f_&{hqXtBPk*fJF>ZLV;{o>IOOLVk8_mVl1>#ynz+DVdM=X5MjF*> z-wV}s{6{I<@OSs1KV}&FH-{g$Z_Sd0ymBIQ;#ylBDjM4@L*%xJh+PahRCGqbo1v66 z_&!@sh-&aRg)ihRX}jSZkFqn#!IvSyIMSRGmsx^i42M57UnrzL97<9&O^H)e^!v>A zgzI7t5>VzHj4BqcfT?>5e7Bof#t(=gJ_k*UPv*AjAwC$RWeyd6lI5Hj^(ulo&O!s> zb1QRK{jQvqIbK}A(B#=-tNg=b;$y5cI+XadI()(@E-SIhvnod>s!}~Qc1{PI#x%4r zRig%ml!EP7=rlDn8WW!o8!vaQo?}l@KsoY(Kw4|RK$%?%Yh5#PU`yD+J5 zSm(B_{oe23R3@Toe?!*wgOTERxA;qLE8c~Qv9XzYq z+(qRQ8IYz!m8X>6iWipDEV0;j7Ozf?ZhO4*3rQXs*QnID5Nc3epy}z>4$a&{i^RRO z4_3k;%>5d~JfprnHe0OXDa7OQVDwLdHF(MKhnfG5Yyl=#_E*+C6k|&#=Y2ErAkV?a zS$tx5{SU955qE0YF0}Ybbky_?{%8?y#A0@z*<>)md>=I68Jaw) ztJH1F{UEmC8OqWuM@1-N+nnYLYgXG@zoQb6a3W+$+NqNBdWFVYKQLHfAFWuFCEYna zOwYb+DK48DmLxaJy?+M)A4$}2=|^E6tw7s*y*(Ow>UwcHu5w6pz<97mua3JzuvMT_ zz;^6=UXwoB?SChAznhp$eX|^ypo_gwfUV|6u(Q=SNk$6QWI|sY1{+L3_?D^z<)%q^ zkH5#ac{xg+&>c19=qRa=gInZQ-Z`t+$}&bmqqL|YlF@z~mpA;0K(xp=+XpX8R7T#^ zq+-;B3gJZ_8GG@qlyyHWek6A)?g{gl39a=r`?YbWxav9Rxl~$o1`_*7oq6sqYJi%koJR~&;P`dKObv5=_=*+ z%j2v&pCwL}0~|9+lX*m@VhL$jb&YL^&K`P2q*1?pgnWzXH;MTk8&~+&u`pLbyTj-V z)K*S1Xb^o;u(7(|zH6X(Oy5V1%t4yP@@cQ<4`*6sgMp?7l|lg5P#avNc9__Xz}b$d z(qQ$Y=-t4tAgQ&#e;WBq!SQhdF%4K3Dlzl4(vJ_-P#!#A#aob8`HX z)_3KP7_@4~^(|^~RFsO?SoiJ0Wql6gj76H57(CChSlz$p(ax8tQh zS8vCMKxurQ|R?xGbpd(X&>%^!!N5!blM52@*lxSF~0C~QgO<0VI14y*jfQGZVe z$3yUE{>Vdlq`H@#KpX}(cOiz3);ljdOeoe$bBlwcsa66zNd5=E%TUBVAy%wsTuQRe zd`biw4?fzUi;5uS&|?{;k8`sfbH-)?)!;n0R{#C?0Ixe-??eZvNH7mJF+jv8^vPnz zj$8hXP%r_~g^kIyHLPY4ZJJqh~}Szdu)AY$4!cQtD@wCd7Z4$ zsNTBl=3iU2+$Go9n3LiItn%&{iwk*iB8MMG7s61CqJIzU5vG6Ebr-Fv>g-57;TMA62LuA zk6<8sD#<=~3p2MQxpWe~=Y15LE5=!)p&7G_zpQfHF2-aR)n?1~v;=g*m?G)Tv|=bs*FU>Hv&~p`!@da!? zDvNLEUxWmCID$oDP;o@E|0p|Y8~J4wh;}?KjFc}j8t~wUYoY>$2E1QT0@t6w5U>=I zd3;B=9;?*;F_*Q==BLtG{ra*-xuzyEEf(HChJGl>$&PwvW+_Irk#Ci68qWZxrs4{^ z3Y8FSOk?jnuY#kMl_ePfIf=w^N*c>z2r^naP&s%7MxJqOxh>K87XV^m3AZD~D_gH}AL zCXs8SwkWSmmSXD%-KwBKtMF-k?8p3HCQnvM3G0FVAR}BejZxRm>-C906Y8s)rc-EG zAEGeZ=l>5koLu8lS0dh+GHSx*7#xrTkT_51+2h**c%!psCugB+yIyG@VBw?pUW%OtU0Q)QuL>M`#_);o&j=Z-K$<|`wj zmFyOWKC&e;StQdR+dDx>QI#M~qs=V4S+3!It)mNzu4e%93pA{SnFU~@@&f#v0)?Z=cF1O17eJpzTVn!!^<(h>1MjFfGChW%Jr0m93#5@0F zN@mywyRfR%u7sD~?SAv{GIsqb$A({GDz#y8aZB6uDaPPf92wB*!~BVDK!M%nxBn3T z-E;zYSw=e4jNK5bp2ROVl%l?SyawMIT(A)8z839x*|_PNt!C0sm0>=7v$KiED}rMK zIPy9EK1g?`P(y+Q{FJ*wcX~ax8BlJbu_KR>=Ye)nf~ljw$6LJJ=>k8Rl#PZfHKyc9|MXSaVQ zA3`NcjM&na%rY|e>~8WT{2JpZpRV>|NbHupVtsI1LQeFLlP9XYuwt6^BJ`EVW@*{- z=cH=S*8%P{S0_AN#+L7*8v#p~2}|{5HDyMS?hijT7yp!s9UX$(R>?F{=PLD#@Ni#k zn1e@Lz~r@qyD6hOtZc4MO;8A5i3mcKu+T8~Gye83KpM2;U!^ZHi5D$Ni7znSa!`Oh zgTGKwT8_>Rhg&wrN75J4*1W7^k?sg39%qPT(#i#gd(=bD{<Y~tZeKN z94QHWrZ847F$?qZ!fc`H!3B-A2YH!(2k!)#<%Rpr2@op>OULG3NPS$Ct;S;5^A=<< zOd#NI#f-TN_N$8n0HjycJ+4guaZ2V+Z@R-WX4YX*;031-rO@Pl>XX@5dMn6dPIeQV zZ$IRCCWXfCQ z?C{K0jfTfPlu#y7UVkP>=ZC{XyeY{qHZ8w4`0qF9w>pR&jZ%!9x4PM^9 z19NK=;=U72xMatt6%jbRlJcjk;1iEV=$z_J@g36%5M~Fht(8>XUU$-~mH*r)`uhx+ ztA&btY@07q2y&8Nx_dxI^d$9ou+%c78q z2y!m7zX*A3Tfoykq|+>=LT)k*xCKGbvk>op)(A1QZJ#VYMjcCw`8#T8KAM&Hd~_^AD3%5Tcz z*MylP204Us7k$>!DR?l_Gjc->EiX_%BfjuDRcfrRp>ErnDLb_v+GQdcE~S}(%co2p zx#0TWMMa(w+H?vuY@686qGygh)4!@WdaFN|7K$`#vfYwBaJ`(A+WQ}%;m{t#no<-m`$MJi);Kzse^9s?Gfgx54_wmJ@Lwa0Ta zL0i!WlHyyrYp|ef9s929mvut} z^-_x6cc%YL8omKUZA$iKqIzQ8J}sI})+2zG?`}RFMh*IB*DTK(w%zzK(mR*ls-8ow zo6N_s&A`K*RBR*uJObkMrQK%27HXU*SD{$Oi*(=GV>xLwEBm}12@!zRFdJ`#>X+vJ zPXw-E)TypXlK8||tiM5Qh_qgUI6$bOvop^`D`uFxV8fP2yogo3ul*@c zH#(e}x}}9O+5Y_}w?gwDF@4^wxOg^uEu~zF4v=N5>0N)E)LU}Vn~4fITmMYRn9w;N zG-v0d*tC?^xZQE0u<6mjJ@!?;me%o?#qYer-Kyf+tF<=v(&xfI#HEVL7p$K8E#uDbEr-ArL?<4H)$q%%!g3OQo@yqi zk~#d{azckCR$bKG(G#-k_oQd5O`yr?xRps;FoK-X(bPQM=mLC?Q?RhGFg9*ntAdr1 zx$&R_h=p-@QV7e!+Jv+Gq}*n$F|OZ8kfJHC+s*hl_bs3;5(8ct;koMs?iuIub9&&>4Kq2 zJuxTclnwy@!whXvydLCgG7&&8rCfkXi#jg<3H3cLWpa2kStp`8R*n(!R(^M=IrDYR zHxO5&t4}5UmYsqim(V_m2X@S@R>ayD$SG}?dnQkiq>*OD**iYUCG z{)fAtz+$85>FW}mKiMnw(@~ozcZPA?8fhf>cN2Ii85WtS$$>_Z$4c*}({o_i+W(mh z^dA5p&#aiJ!3fu+zUyn0Yx8we(i<{NbF$}3Avp_+epuJRF z%%d_lyN+2zZ;HTxkw4Ju5#GlF1XpzHOgci6``SCd$ku-AL^oN|%h$wp{cV)qEo0b8 zKSSMqe$lg%tm~%(pB@N}(b0);rnC8kEe{s^8y4!>6tTbsye!n}F?5w#6`%#A5Mc@a z)D<=&JLlZ%Wi{r@i{(#js-{3QY_oMpa4x5ne;wup@fag&Vws*dx-4AT&7IyXDX{Z{ z$kxu&i!AsYsv6D?OwJV|n2$4Ma4jM6atEN&*1Dzg9#NP{a2w8_duNy}7^_)nyX2iI z{v&@2iPN`ayx07v;6BL_Mw9*H*lo{xMjPCqIkj=WQ(feEWL2G<=r2nje3)g<_nwf$4EFp4H0&+1 z(;jk(^JhP-^=$ShI*1X7tylLrSum<&^=PupbS62fhmO7<{Q7X3-T5_P=4^&-1nAr6q6Jx|b*d??h$p^n-MynfzQ>&`u_+J-<~#%0mCaYSbz1xb8Am_XpM6 zMGj-Mx-tTEBNq0w9a!C4SkHn4G(Ycp2}q=N>HF5U+HS=5iZDaEpt~czdHlVMr6_!P za%veq*U^dgt?n_{W+XLibWdiaiIL_tG`kQ#iCCP=W7VKu`3)o{PEEr zK?KJQ1|b`-Wu^-|STbN|{p0+P9HIzS&7hcd3I?rt)pSuEsjmD{V)=Y4ko7-E z^vT&-RY}R0e+g@(w33mLk(?aF$P?^Q)MsaBThs_4u8 zEHd(wH4d}9bLcG$Kp55UweiFqKKXA)&J6dLae8gv$k_6nJ9SlI^yLS zqC=U0sx-Uh{PE@czip9NdG7D;$H&L*7OOzeWviEK(OmuZq4z8^KkJU1;mg@x0S$S1 zrLC>f<@1#Pw*M9tGrD(tbaZ~mcZGo1*#`LPjtGSR%i0179mVNCsyw72O2oMQ+x-7b zE*L&diNM*t)-F>X9zsV(Y`swtgN1lTX~(9vrly0#X)3nPJL4MN_bf&I7!y@3`ztbl zr*qCpA^3`&6RBvx+R5$zJfw6%X+;HB<~ZUFzf5>_KApD(ibq-EY+yS--SXNmInVcE ziAMk1ITGs!1a*(K;Rj)Zv|rQelSbWcyRBI^y6jknkNx|-bA->!6AaP`C(k)RdHXO; zshgb2S*qFUc5og;QZ4>(6Qs2Kg@uI%JDt8A7xz3C`O#&aPFGltFub+3^}olKo;apL zx8`vwFX&L*AX&y{Zjm=SI{MSUKmMjLH#Ox90#WI|j&g0X)Y9?@d~x|Nm_OoQW)%@X z{U70Dr8dI7=nVKS~1d3rM%4JBQ=Uo{rG?jl3S7{E^xejK20$f)+bgQ7w5u0}sE1Z>_j3XOxh5{b?SIOOhJR~~P$Tx+U}SKT z#Mu*-BLQK-V~P$?n<+Dk9S4eu1tqUVn3^Nr=_YV<=sk)#Tl>YUS5a>dE}nn4Ax8EY z4tY6J35={oj^@vloGuzDcYN8JB!~MmL=dAn;tVJn#Dd`pP55YqAgsRg(v z%h5+6luyG_w73aL*@7Yu*6`;bxQw3Cd>IA-u{b=qPG zN%15FLwh7hVs^!O6{#l|WyL!>7I0{Ln%`pSfn;;4lgH9o&rckkHdci>NHgg8sOD%C z?6|j{<3#Qh{Jdb{WG~fiZDt2K>w;n88kJ^3giwAUYg;dPaeetbf}vpq7(Rg*J5r$E zSpx!fNA-_(4s}|tePe<0(Jj;^Yc;7QB$~_UddW?+g_bC63#{^Xy69NCVD}79xIin0 zR{w4WWSVTUuD#Y>{KZO=+yA~C!&{6wN;blBr%ULm&Okl{Lc}X!qf{>PlATtj2=m`7 zmbv16p6xX@lA*Gkv)yy%s4of~81S#}jU}MQxqNd+BSmY$wi6YxCq?V?qr1}V5Qy!X zBo@)WE+c%}L%T>YtoD_?PYjW*2dI1CRx0PMWGS!y_kXqrd+=k@F5;YImh&9j*|F*g zSY33{zD9^$5X%?o_c%3UV`B>onh{Jr{H*nvPc05gd~{Z?vNK7an;Z^PI%euJ(DWPw zJs@YrqODlZHN6vgGqW4_6GGL0Wiqod$$fFQT5*K10ERov=K*ms%NP-+cmwTW;QpJCC^4{Qd-h->z5O+VyOZ z_^IqZ$p;^2%cl{iOv?}F z#FiUZE=hCH&9x_%M1v)Wo{|v{21Zbi)ZR9wC{1*?v^8QqOt9d;M#|!rr|o#ypR{ke zE_!EHlQlFhMV(GX;kJ1NPwHc3h$PxcDB^AkIC6@O!|b>n-ROFGFkW(Yr?|G|B5p?B zG~2)Ry}rIy^Bl^T&CQXylQF5_ zQM-Fd|Cb_nY{MpbgMvlP_MKo#K2;lmS2p2Qzjnz{^=MGD_LWFA$XWInJz}UYEYxo_ zdwIq)u4Hw1JdX0~iX=JkjXe#35x(4CoqBTqNS+q(_<_HLIg;L``tU%UB*f+GK1Gzc zn`WSBM-2M@Br$g1WO?}=ECGmB*HqIoyDw!6`E0cgz<7%%n_ND`##p7RL+IPIUh``f z8)?&jm!y8=y0tHDlbT3|0eu!zl4r)9hj$K9i+qeX~k;9hyI-4x>$OVP0wuV$t!oNOatQKaLR z`TQJw?+VLG*(BiB@G0$UX}g^Y|Fe{UC-VG2ppfEv^NlTbf?(3O*S}Ozno`BJ>tZL` zid3zICgN%~Xi42{BC*nfwV0}?xpP8&?&LJ;%OWjOROz4gyDek?YOto(mlEtDZ9eNN ziZNmZFwEFzd!rLt-3tmr{WexxHEodf%le7-{`fW=o5eabqOb3;JYfrKiV|%_P(aa3AXl|JzI?(i^52+Gjw0uuyEY* z;V%h?Yto0;CWF>U^Lk}-bXaWcjZ~<4ocLjmIIod(nd_zR&knlU2Ii7wR8h@4UL`!# z<`=!d#=M^ILtjWRW2ulhhI(+&_)WD!nvb2JF)Y>>_s2Av%BO!R-&z47xzE=PT?k(q zg0ogg`{lWgjNXX3cw3jx338AlEW+Gc%J?=Yt?8-bX(&(>dL|l+Fy&tRn%|J?_Xvw| zoJnpsM%YE>F5TyL9qQhzV0b_95<@)ds2w(IQAHzAid zV-c9}SGi~1VWbn^3V(wWA;(b3{^Kh~4OTx_KI&j?T#x%!;yr5_gIwown*SZ;=BnFE zw32S~LpQKZ<8?C(Ds6iw$pK2yj$HfPSM2!EPgY?Yq|EFtr;x1m0g-X-`De=h?ce-i zig1*i=Y^3Tf$%X_N+13iEh!9`@a5mQm**NZa^-|i9n55`0^~c!$9(HwBqLlSt!EGw z(TSFqYLSijFoLv$UOI^1w~iNpNT623f_b-b^tlKJaUa>w0>OZ%!AV~KmhVLuu$5mC zznj6LFM~VtyB)k095xNsFS*ZzmGH;1`&ac}2Ll7I0n>{wTcac-N`>yVEDo^Tji;U5 zxBQa&f&$Xzi+apSNgTp~&(neJem@MpmYH>e$-<_tuJ%c)(-I;|7CGDf0;`2TTtw~> zbCV@*#z)Eox7X)cq|nZfSnAge1m_nB(h5oxN5C;5_kXptn%aG0IJg~{`TYG~GPMVH z`*UTJ+kQLlB+jXrq}AEURL^(*x+6w%R$d73T(@9aEJ5XOJq&?%ylmoa!;O|z>#R*^ zd7U>`VQr57TW)q9R#`kE7c(cKq}D#iHHlKg1|JfdY<32)MB1)Hi^#taG;tvh|^Gn2^#Ush(`ve-XLRkvaDJAobY$4%DI_iJV`I8GWB0 zaaWIewo#4nauC7iyHn88I@{?Y^*+w-$DBuO%1LRNX>f?s^W(^N3X#)rbez2t2xv^J=gl(boQ{z=_an*7{uJQ4Ciu3e_EedBN?M(AyHT zTnJv(Jt9fSzQNuTq6{&*fg<&c%%;4+Qzz{6(U8RA?aI0R^Ooc)EV@Ta?=Y{Ht zAiURH>5^pw>_2)el$UY>g*k9@@&1i&QQN8{dA`rV#US3eo;rCMKYaIbF+7vTP8$sC z*w5INXhH#7gC49pgjs8RG)9q=jPq6fR_iuIFBYk`K9+)ScC8jVVa1~4Xa%de_f+`{ zkM1X3j(Ia<{TwJcU}#;My-~Kwb%PIS#^+bTC${h=nK1jcsST~uFWloQosD^8+;n@z z5$Lw=i8>Bcif$C+@7?K$9T~|_M2^hHT^CkAM~*la4u40+Dr)5}tzTs_UjdM>Kzsb6 z+iP4k^j;~6B$~Iw=gCw=g}+*u&o@>1ZFaAS+dlrK3iMxY$7z~zIfDd(PQEO28gzN^ zb6*_;0-LL!QACY6F4Rw=sxkFt@MP`oR?vAjbTjiZwDxzoD-8lRJL0CcfBv6Q+eHJk zJJ8Bw+wAJ%aU2@+l`>qn?>~Cl#(21yXok?3);FEqODWV1;6>7(N*lDTY)r zPv9LO4y1SPjQ;_-WuP zI8QV2q~Np1{zE&lY)@6u+RahW&%6$eh4`4RI;Gb-b@(k}onr&m&WQst8o)-Wj4(JqR&fMb-ZSD4Ji|0|(*5&}md^4Gq!M$?slD4z{jRL#e$F?Q} zMjo?RrEellH0(MQIlx#Sj*FAaM9V#d2*}VWC%6|LEB!3?yS2Ggm4H+LDrS(2vA38; zvdf<}NrpR1Eaj^C+0kZJtzvX?yV=IZB9Du&y{ppU<)XQ^xk8rbNe&4CnOx%S;K*!j zox!1JK`ol7d>4Gd`=z1v}84 zRunDeCy$`Zv*5e=@2cC7Pt0s8N@8zE#1D4p&=dd@F22|FQ4n5!CvyNqB4R9G945Wt zy1}>y)Y}PteaoVa=!hzbD`Ta8;^iA8(%u1UdFAov>^h9c`Ho!$EUvkq+%aDE&C|Pf z>x2XWzvk>9CCt75L@O_TwUntC-i*dIsB$o}BcO_`(o^zjb4KlPZ{LaEa9>ViT_hUY zANS(5Zbk70xpnyiSdF>FycG}{q+sg9WAxT){O=l4#KT_K`eHohqWweAR9cT zci$bF4}{Ym7DgRgfMz9?9VdXO7A#+sk2M3P@oo0nZ+WNt%bhqzE2}=IL599Hw}ui7 zl+^5)@zM8P=Iha!%hEP05F-%GpR~G7aY_43=05U<%GS*8$M@&B4XOLWRD&H`^n|43 zwJ4?j5{{UJSFcf9zl3)Lr#7yI55|~rrYPfh!B*QTVv!_OoByX4fbOG$$w9g9U#&Dj zVUta{e_nUrQ&Td^V;{FiFg3RA35=95=%(>n^F#3yY#J|w&75aod;%iJevHg zpW^VT2PP&RnZ#2o$$c~qkC_x0bUSA+{)Mjo6o#+$3om3%96ccz|3C?y%2bThAUrsS zjWfm8FKN>!$Ym{c-z^5#e!Y4Uz`tK6t+LEq4 z3AYS-&rqx~DLFmQJqK7(!TiK##lZT@X5xqbs^Pk}w0d3sSIdE6C=9jufE6+}>ajC-vg zgD$6a0(c|G7OMp3&obY}R$d=UbVS(lFu>j&9dg~TYy;s z-fJ410_P!eO2#=37rs0lg#p8W#}0A%z5P<{N{$?T`V(9lr(2b%U-USW(o1vA1!z1& zlq@t8LZAopK{LE!$Opb&WC1$90p3`yZjAA(c&wOvk;tZo|8yJrN4r>=NP6p&l2jO5~~M%A;{`m=(7vEDXoTV#UeUTXvau z>FeUGI;j}*Jv%%s3o7RmB(ICyDLaXsXg!Rkr0RLEUXiSBzZpHD z#ubmHZ;70usU+p?;MVIW6?HKDSh2f_+{vlTLp`oJ_iF7VyW*8b-oTE?~$DQ`Oj}ud+|gZ2;}uMjZr65bg})~3MGTP7`V6e zTo^R`TG97zgu&Rg;YLV1^7nvNX^Q183XC{$2Jg;@LsWUkjJ$U@;h+0-EI@U;F-HN=7h{EdW#o4FM z_bvc-6g@zxgo`Z@4Bbs05$C+U9ea*qC2lAX`bkhM_@cRnDBZ?Z=rFPYOpMtQ=i`%M z-(XFRj**G5Y6GVh!&h_c4;Q6E!x@XuQG5e zSGAc7XUQQFMqFt9xBY3!(sSgnOM!+**#wm>pG1aKl^J}P$n`>Dy3Y5j&wM06M>q)2@3M~TWV&wb3vn_ zEO3@n$*Yr8p$_@aCJqi?`Npy&@x8b{T;yo26GCrzt}PD^Scd>dmCF_YvL|kN((AmN z^sH{>Kx=d8ANWPW7PFyti1JWWaM+LF%E@hvxO*dZQr8s_ksErdMfA-ADI%PC?>KsN zzqW(hZ%kOG*D9^W#mfB8Y+U$5D+$WX<@LC=O0Iwpirv!$Wq# zwYRy0_j31vJ7jDEDGITaq6vUzGhX)PWXPnBP2X6@ru zd9JvV*dR^gWUFyKH_)IE!`W4b9W#8O!`vaAbQq^b@cTn`nO}L?)vxO+3tcV z0&`tt$#T;cy}4e>4(1mdKB5sV8A=Q+4ivjc*Q2r1skpx^yK32i?&WT7`Y(1#Zp1i; zuR)=?@B-!6tP-I5ogH40tixp`BmRr^oX?D5puM(HhdbysiLIYLq z=?f{%0yt6+``5qrO*vnv1`d{EIT06a$-l*uuW%mNp;C*Ci+rFzxxWF3lSXEJpD6ZC zLX)dZjh<d2*W%wMvm0+x69YB?`$|%^R0JH}sf(eImL|E-Y12E`3EB)#K6V z(D!I;rvSdWwY77~&zGkoA*CSr|3%tc2gTJyf1iYe;BLX)-5r9vySuwPBoH9D%b>x7 zyK8Wr!QI{6btid#@77zjTU)!e^UqA(+xK=)ci+C<=Y0Bmj$%L600#O;8~&tM9km6u z*XM=wyB!1PzUky>CY31HkqL%9A)Qn-M(g^CBDeS;-P&l3r$n~=$gP*Mi%E_)_DWyV zO3$J-Ej9Z1k;A>hSXBDE+&3A=84@wK)8~~G7t#0wC3`Ymi12V%Y{r?p^XJ+e1v*+L z^v9L7G{D@XP7{c1WSk4j%1mU*@zk!8rA-7zcJ7M|;-L=U+ajwY=q<}mh7g<5C@A09 zBUGj*6T7UiVr}aSZX5Cn8?axvZA>XXCl}RNxT)b%$rT%~rKNPy8w!AH;jaAtYjI}D zij0yQC|7dSb36@QW;33>fKj?4F58!qh4?C(e{2db2@eVFN$61%qFK`cte!tV+QdkX z#pgOY(HFJuAHDs4wB+Gv7unzqAE}ZyL|CnpZnFehan5G%n6a9m5u@H<&uS-EAV7Y6 znZ(SU+>YvFMFqkl67tS0iAVVx41CJ4xx56m#!Y-mZ59316=3YMAPUznLNcqXZh0BC ziW{S4S>9|=wxOz^dL1s`-v@XU?>~fNf#ZH!w$ZU4Lj&+m?ADbyh-4NflTkJHFlNEj)RCExy9|?1MT+(D!$waSAth}ISN!sVV z3tvl`HQQD$?Cl|LY>m@$ek?7s!yGTduB1M1#P zVKCy{b7p)-Y#RDw?}9?5v(Ur$;~z~!b%5oB7t*2>KSR}Tt)r6n(lwwg104{1THpk( zzm6`V?qM!CXAYIsUs?OI-OBzo{u_v3%GRu%jJz`Cst3lpubok)0M*oh4K?{NlI`-W z=t!TDbR=whr6}2YESgIb4Y)1OweER46xi+3s((QJ*(#jE9`k`4;+1_Fe5DG(5Bo!V}La;bN zif9sgReA<_~Mk!WKW<<2woDgyYex z{avUdUH|y-*g9s9%y`q%!q1lMLFq1F;|8abLF$q|lK=hX0sH zSiJ%}?sD0x2$2jaHIX^bOG$qK25R+!lRJC>qead1Ay(z9=HfK{{UOOMJ9oW|9ws4r z#zM_yw0X>5WU(2@KQn+g<0+fJC7iTJ3Gd-S6|p91Sp7_SDs@1c-^Hba8_tTpOB_zV zt9N{k&@rHQEVDl_R;VxXQqNvkt8W_VoyNpsqABuV^?sUZjDDBxGl=fD)Q|3%vDQ2> zFK!!e54a>i=I=7TjUMH|@9&F6gjlD76Ne@}0|~yr+$(lq;lq(aP$qxfJb6zS>oY7f0Ul&$2ji{y9XRKD_|4K~Ya-%iy z7$lGC0g3s$4>DG&7yick)q%?Vi#JW)N_O`lSF_cEqhmNlUK~i=h~1^=|Fi{Y!{OJ7 z7xGdJF0HNYnx?F&I?mDOL@%^8s+18wmo1&jSzI&_X_U#h$;1O-n9JzoQQ_N3Ij+*m znYj=vMJ~{| z)?;}MS@0I9u<(uYZ8zueVmI@OhMdSpzn+*bhVt?~t6aIeoUuTAmwUQ#lVtR-RM41^ zp2SZy4+0kPix)H0eeX|LlTnt>u>p^E+9aOG z!{lG(P_d0m&sEiJ)J1FqZ+4<+aNtV2mds4ye+TWQ%v?cM6pZf!h}Bj5etGY3`|7X# zPN8`?A;L{$6v-BZ9swn658@}um7$__%t4?P#rl%SuY68$$)FDw-L?~EKWZX6s%JaC z*P=%nADX3`FT6Ohx0mD}6F#nRl+`w$D3xb)wA)G{gl4OmXH82jJvlq!8PG!`iR56* zq0u?ZGtS59V6Ul=_4ORyOsIX*Y9oHd85DlmK81*Ey0j>nNd0n>_yGu9KlBt#zxg~&e8tQqgY?W_{mrx9 zDxB00Ly~MmF-810F^_>TfqZKgNhhZ`$zXrdpu7YO(|7h0StwH6a5f_Mu;1MWy_9*A z)LSq-U$!nE@WC79SLhF`g;40!P0sGyt-f(9`{TMK)@zKJ!u@Cu{v-)vG?YSWL>OXs zO@b4lMDivW+k;}b#d3CD%Uj022s-P05*-(?a9M6O(SCPCI{~!J`a<01XZe3X-Pnb#T*Dd9E$Wb=s3{N=JHH%k3D+1 z8^JUO7TqKI&MjZ`L(sqvZsaTkOZ3c@%c_9|q)h&V)S7{+BS4_0zP+B8sCbHVrAd)W zr3UfE>m~QfnQ3KZ3fcNesr_Q$LHpk6$;lWHSXosixzWZ7=CjBo(F(;M*pKxC{^Xrp zckgUXW_)ms-4QQQN-N5@`KZJJwMXq zakdN*Uj&?_cTHG;*aE7!7^$EyC^z^+L_P+aw=?w}Jv&QG&&QKf@*#{C*s0oj>Z2Mj zfAa6gb?n?%xBVtxyvJ59LI42X!fq@2@mXGlvb%IYHWA~Z%CHt_1(i$`bFK|BHIwsH zOL)m4VpYnfrp+-@l;=&R(=ZmjbmKJ56d@Hd&NbTREB<@~{)N`#UtultrPtV+a;%?W z2@n$s+UlHrpRL8^)3gk2;(V8J8(Ut))RLO2)q*K`f#q?7N8Je8G=iO(jat^QOd?~0;3|gYEq=fts=Tt+X|K5jzKc85~XsZ z&F^?mteYhf#vk)Lszmn62NFZIL}u8nguiMU8?RkdP&LA|rr5JtnpQ>((2OUL~R4Z%Z5wrEP|6#~nH1R_a*{qavBSWl4RbrNYQHWL5EPfp3PLZ_fHFLaq z5&j@^ZiIAC4TV>S8F!<38uM!_UZrkf#bF7BUI-8bGoc$0MX36(+JSUeT zPi@GGS&Pa@wEnJg&)Ma}5R7C>Hb-sNHqri?~*_c9%FH<1~ z#{ltw?b9V|udS%XQnRS6iC>%E6+jmFU*X>g!=wx|8TX?V=rm!Ojy#jDmdcZAxfMq( z8v*j<==xIFE+w&KTZbOXM{*UJcxAd{Nny|xs^Pk0QIvdz9L$4mJ0hs8#R|-uGX)*% z!74X6HRI|a1xwo0w!suQMW?^xx1u4tqM&c5K^8(F&Yyc*u<#eT^cq;17sik3FXEg7 z($v?FM*EnQ8J*{EA1(jV}z`mz`Y-IFwX||GK93qVjVy7kDOkjwbS(BH7;ta z4U(OZf!Ojzk%}(F!JGa+s?tRg+uMifz(ps|<8aGSl+4Ta`JhaQIgSe}04|sKWET}Y z7@#v^qgH0gKD5Qs8fgs90H!{KQK2NO-f6+J^d;^kr&#t~$<3^5s#+rFmPF#)R#i>z zr)pI4OzPH6N`5ZKvNWJsmWw`EYC5g%s8Kht&}wds3xgzV%E8?aP` zVZ$^C=<1z1xo~9(~NNvcR`ST-&( z=UZHUL+P-RO?kV14|r$Ryrn(=!PR3qL$EbwWECB$=qF*Xk7Ua{Z_b3;Wy`!@fSJL( z_Giw)P8S_I&jdocDd(^!`9?jDLbDR0;1c+;eG3+Zdg(FmM7aCO_NBJBk1D??4O`hYczll1qiMyY1UG z^a_%8_wk-sJNRbyxqH`25dl*33ydX1=4VA+otCfY2W5^YZ7Z_lUN+n5wKoS}edUYy zBmCCT!SdhP#9(3`cdF4+GVf--MJg%(5w!ekoe+G+;g=#BnCON03ix78)>90XoVY0et$KwOpYJ4?YqGv@@(FrK+!o2j@S?KCNgE zn6*4P8M8&q7(CI~*a%GL_)m>oP8A2|aC}^z8foil!<8^rQ&lw(tZMup#eHaXzSdD# zD9-MGNOU{6dHLx;#gy~rVDc^J?dEN@%@eFT2F~+vHw4?j3+#SvZ5;#O1`YVd!j&p@ zwBx)pM_BM5r|$+P)tLe=`wcx#m%_Km3^t=C7p?OS55Uwf%NGQh!l|#s-7nw%-VB0~ zOQz6et=)Tfch|A=aqqaQ3%AQGbZchMj=t#Sgi5Go-im%?cv!te?Z5CdF56Dryu3>p z85wK-_Z43CYU;_qMoQNS20_=5)XgYED4w@;A&CH}ul zg53}JO5FT>b_)eH(BkT9grf8J61|vAh2r6v$*HNEv$l6}WsHd8htN7qIt_u_8MX|r zuE)#4z_XJRH*m-Nn|#A1Ux^xA`Fyr><>~29#W?{c`#>foa6C`g58y-kwPuTdwbK74 zg(!;L&k1}RWqNP*f9Av>y7al=QMJ&}_Wnrzuds4#V3xiUT&q*;tFz`3&M2t~Y~R0D zTPn(%@3Q{G)tL#@H8oRHnSP3q9;igh4lh34-p|ejOwY}Q{+9u`EX_v3&ZgTR+)Db* zsiT7+O#=gk{-=xh_&&qI!71bS6*d+9i8JN&{I3&O9}UHm@$j_#Yg#qhhS6P-e>a=P zKzC2;4&H*u{vQPX|4nE8f9lV79UFLOe*4S4<6&L?`Z_6_TwVAAy3AB{hSX zd4m9zUt_dv7M4<8lW|R;nf9)E(daHQ=T?#?sj`G{FMJHd&+TVmE_5$|YFIC1B*7MY zH(Y`$>hp@fK#@eG=}!r8-rbn{GKiMNy@j+4*NSCy^enhUZ~NHy`j?>Wo*!2TS?os# z*7hVkHm7!?0VQ8fSItR)L$YaJ9^xg!{7z1~6=C_qx(SAQ5@)YV3fV3Em40tMSCCNF z=f~D=-r>}e^oh1Rb@1%jM{5hL`I8%8pWg@rlX}rd8@xlOD6GyE>X5galnTY961<~q#z9H9!so+xj-A!0kb=@|`*rk2#e;Rq@>H<;898J9!LGnh(WLotazD`7 zH725-^K@nEd#t{R&h9JTSq1(0WXVDk09MfVHC#R?y6)_9LbP#!$u6JCr~Knt$b3ps z;ZNV6)7xm2vY;8U)7eu_gPFwBnUIbMP(Mt$Ad77OUc4$P|m#RX_zK9qHt8q}&jNa>Z1 zmuTJl#lWpzU&O?GhHsGzIfg@|?KCvZGwqF~rIMtx9*E|}yzZHs8T-*zAHQ2h>!2Iy zr$7{5ur$?1xH_@&a)GpOt=p}sp-^85vP09C&ZV_$a7%1fDKi%=Z9n$@c-FqX=>Jwf zA{lu9GQPCHO3uUep64{injFc=-x*Md6|Yd%k1NqEmZ7SW7OKdRnH3TvQKED+=E9~& zf-deaa26jSm+r>>Dpi$m>EmxY3S_R)AQL^i!@}lCRyQ_L5B=ip`;+fa}lo@;Z~r>~=dfwj+yffOG}lDrs$ zgX#Jc-pE8#=Q}pV|d|zUZ4&#-v*u^JZa5yYpBl?A5!|E!6Lnd!L;_3pJLe z2)+`kA{3QsX_k~dHJ7yDCGSbOM)6jZkz);_WNVkomc`>P{N6dSs*bU4ws<}H)0R{A zC-wa-Fi@XF{ZMA=V!9W{u+3`Ay<=JbcIAj5KqVn1e;yo(mdNX+5noSNB{z|sn{JN5 zTyx*nYx69ukvlrJtI0d-t&g>k7PC!%RX3+)KZF)Lap(c9@Ke@eCK7tlK8Q_>&lZV~ zvXhrZSjOXf<`LfpF7GuNVNPV8@RgZWWCCj6<|Rv%w2diNH#)qM(*z#AH*zA#u(tUt zTE^PqjkP{gn--EHr{(3TtHeGG-?GQ8+=K@rc!=Pg9ag?B#=XtE?w^|P?9ta^Hgp7+dNOp75)8JR)-VA=EW zyYzHa^0i7(QK-aV(ntp|`Ys*!UfY?!S1HZ?YCO>%h$2a?Y%vC`9HIhi<4|p3<3d0* zixgOn2V9+6!qQB=xxp`>zDgRJo#SuTSlt-$ki`VnOxG>eEoM|+nUKTjV>0V0f?toM zli|tJqJr}*VWYwlg9;e7u6xxyC;BOOK6R35r681^U2wqZb@UREyFOh|l67Q}AuFFX zrDP{{{(&Kv5JLiaz8IvZ(2r{h>jCj5fri7!cn!lj0bM-1A9cNZrb08CU)22?r8Qyk z+EJ`Iw9~40%`&oBQXMu~^ONdlxj4Ao_yE#$CdujYw~g1h(ZQK!`qH)aS`{Vk$3(x6k*hh;M<2c%H zYL`1t6xS-jMXj`>pE#n}cW*y)t0V_u`-X4YB!5CxILA?){?IlXnFQ9)7=db#>!()5 z84(4)7CWJ(zuaBecF{|N6bFFCUpHBkGRdjOncrRt!xF1M$%w(~SCs6K7hdtGAW`-x zsGG40?ZbI@QVXEOwB}*2UdaUx`Wmh~9~D+TB7@p{JZ8mw*WP}&>=@+RELOe0Jo*S_ z7ZF(Z+}=qENoz`mAtn#>WY)Fx9=UM3)%kx~NG%FIyT+qoSP{5v^-&wgT9-*yYun1< z+Ol;rH9s6a8n3R{jQj|UkV(GVTW?RD+nG(Y-E^fWh-UcMN1?+&cw9ZK z7O3Ey?=`Y=EPHDbTe22gHftj`txUUd0cBm3=X%#(i{ZE}T*rpye1E^db{*k5{nNvP zI+~Qi+`c}C1LE^(U1P=+_8uk(zA5^SaO0;60__JE6}xTrJ8a19$Q@jcR0g^2VT46m z!9`1|+`kch{D?+UHR)+-GQNi^=fQY#@Ynot9_6DOojpLy_)cMHsNLfEnC)-q7mX$= z62`_tbtp7t&eoh3v1^OWe@^qh>{*eJ)rX=36Xkv=F)<1MSA;9x#~chswpF0HK6z(2B2jA48v?rVGG zjoA-BXU44h=}8CgetEDAEyk;}V)dAL2OC6}7|rgK|Kgu@yG(yKiK~tznU-z{;Js4r zW?9fMuU%kNCgTEE-o9`e{YzNjqcraR7W63b5>n@#ny9_%w}hWJ^JCA8=oBHU5gKOG zRqy9QFPK&B-1|G67qfL5uUhep;?D6AGyyk}MDypB`9tvd(;HJVXyIlDDtulSPTt-; ztr#*1ErDQ1;mR}|-bd7@N(awgrB8oXVH*iL^;hYEzK_}hnryQ;qz=$D8dN!x4xv`I zUKX$4FDjCSy7*Mj_?`|2R+s%lqt6+K1w6ZPsWSVscvvrXK6cqXxV(FhtLy6WIj*T6 zsK_=aupxzBxxs}b(Lk8Uj&e&|bx^=YZ@n>|O}FR6LoK%Y+A%`#9)TR_Jx$9{V>)1GzQvtz9NDyjC>lq>otL2VTm zW%0|$&^m7EW~Y=q6oHH2G8n@&!O306pGC+S_)s%e(%Z%#JgH^Dmcw2Fgx)@tH@0(5 zB<_#@R!P`YY?4f3sz-tnt?!LBtr~4k+sHGP3g=EUjgmLWAYS#CqB(k+t+zpgwrA)% zRB4^1{3gE(WUk--fxdQw(94!WuVno*eB~jryiblDyM>w-xsIhd-X*z*N9GjUmTfyd zIZWD4?`K>>npKkSL|Wjifs;ssONxTz#ym-t4Dl_@nC zKzdV@-+7?CJ{((3?lxUZZ^8I)8Q$HWk(+Q`bOrHE>YYkm7at%LILE92MJ*jFtw%!8 z_N7uQB;O;!gs;^3wrnpMWFnZnXAm8@v_}$Wa>SALqFtv^F;$&~>0${IgO1@Pr9j7Q zm$qDel-ff__J4vI*1tGGraG4ER@`Fci$N3ZK`g8(psr{;f56#(mqhhp`|6Jx(}`M; z2PQk^hUEh7m2v+r;JU?SQzE>jGo>jn5MNF^8t+7**I!U70!)lIoBzNJK5`%4Mcd;O zl4O!6Z1Fd4<4W?w6VcFa*Z400>kwPWwF5}+E|vS_C8z)z>giCNT-(8G01sh=IBbV()?NZdDs*G?npGACz8Y2W*an!DlTEd@GH-FaCn?* zS*W~3B3&0)+Ih5YC_?3HJ12vH zSEYF|iPCy=0nn-JSQCEvN^-_(zj*egHQhhe$~NF0-EB0IOJ8wLpr)p^(W<|pjuJ+2 za}%a+o0^3j>{@q8nA1^bdF@82Xkz<*YBUumTqcG-X_hd6l$p7N`Or zC#mw85~|uZlf$TT2tggb!$;8^iZ4#HX)pZ-+ua?KOI7pxh);w)TLU73-g| zQ^dJ>x2IS|ttT2lyq->cMI3Bc*rXJ6P}vm4Kl{qJ$VsJJc~DJ&eY#4T8zIQFvmENs zX}u=@w(a<@2TkH8^J`qaR+ukzp1{ZWv+p>{rPXRoasw@TCntep&tt`7>|;q|H)DEZ z?PF+4BAY;VMr~U)gR$#2Z=3Cd*gSv)D9YDRT^KZgAznfsOCc@Q>hw!*96^ znw(;o3A?2Cn^f1&3ti$B^sU3;73p+*rq!`sqV?yBKkJ3}khm-_2cE_9PGaWAdicEz zguz~&P$oHTXHK&7PNIGjRIo~_C0fyr@59+=x^qfGB5)Ve@3X#EAkcK5-BNcYugS^Z zRO&v)VF$?R3wn{xh(XR7z~}r@f<*Zpse$QobkBL0g8(5C$u~5WuKCb zLjN)7>u3|__yx7+27>GCUCJxxa4W;065&*^6|lY{pG>esuHe9Api2j?!z zsh&f-;?5$_&>4;M_n%pE<%*`v@kX#l%^Td;eTZ|S!zg2K@ALY^k$HS#e?8<1>>a%u z^L;cOJ}fM&eVO$|CW_RjksH=V;tfRYIT9DAWdUIoplB9hxKfkzJ+g|AkkC8OuJI** zwdx5VS8lET2$6<{k{;mQ+g0qBq!P~}gd@8klPGIs#qIUGYkM|~3vn9u21AP4s+deT zwrqX-^7AP6-grurH$F*UG6-13Y=sG#{^ewG-K-W03^$1v{&u&lqob9pYWK))c3i*f zt^BPO_}Y_n=6`FUuy+eT-AkxKjRohtbLv=OZJEM0w>Vm`2-*G*B&v`@xkXNwuZZRh zijn7Qn$Rjwc7{~AhUgcrIe$%Kmj6ddMRLo9%dda$m~CW%Le%pf&NJcI438)@A*4E~ zIdLR+V7>icwt!l0vhAwW5)qxsdyV;Y0jcyZFK6YM`m9%N!LD{GyX;?SAMjr5LuaaJ zQyNao&Lb)^2Qf@oz;fncb{KWukA;gRtc1Ibji-)B=JPS5`+Iv>1+2LrNk+80nkuun zPq(nCZ_On{Lw{i3A>-RPIC#dRpAYS%;dYCg|91DSi_9^o<&WGZZf33dIt1(1L}*vf zwoE%lul+wX8d*k`Cp9T z=2Pm37xW!Il|M?x$&pBnDgYd@bm#{@hDYOBsine*SL)5sA-q>UX-(Wbx`QCq# zNRDv-VPeUf0*dtmZHICg%4CD%vN87l$+7(le6ai)zqL=zWE>c-f!RGMt>PUEm5d=S zZ1yuqfkXDKh>ot%7c<-0*xAE_PYV`(uE-kau+X&HQvKL%-h0gZHWiF#`Qofv>DA~q z61&vi?sb?OliQg}=*74ZJ9t5ejnuP9y_eAzNiU-e%K|M!Q$B{ioN=e&?bX_|MbSS4 z)Tx`7cDiw4*@I&(#Q(W9Y9=yP7T}j(iFCtn$qv@X5%s8*5EOlmwzhmnH-)B(tHYuZoU!(Pf z*FF)<6-I2)ciwIkyZ?|gRMX&R($NhhXMc;y1c!w|G9=yAwQ1r)@w-(|_Wm5bA7}r< zM@CTFG+#_lKMHcI|9o}DA?&KZ{HST~>f{~T?Ek*j_=~-bUZ|=YIDkZX1V-H!myc~S zljzyH%DGb)xO5gcYmbPp{fT8OEn@h6u^{~$KUC0~-W2?#Zld~{<6C@j$&`GFRPH^M z7&DBJsIQ;K-sEMBI@c8FsGk#yCeyF%6C{hAA8UB~8^~LCFJaNtE;UKcLu{v9`9pW_xU##!EgCLW2enckc{b~UH zQ7v`O7NLlF;?Flcp=la6A_VGv*>6+`2UY~drGVeW_0 zD^VD(X>9U*3=*x(_Nimzp4$8Q$TWa{&D>WWWY)M>?u$oItxJDm|MT&WDC{oj+o$8g zkAlz?Geb_Da>GB(9BZ7==Y%T9X zoB(pK!X+BPbs1xuus`hJZPH2oiU$ehe$UVjy*+ufF-hGt5pgDt#Y9$LdhWac!M0b& zn%ZKD9aq$}G-(oaMY*LVowmzzu+`Q)Ztsb3Jp{v6)gZBCP=cANbNZy$Ol6OJ^9TX6 zwu$4;Hxx{?*VQ4HxLr+m!YO}9&A_U$6fVb5Wo%lvq`HhxW!)=-MCG|xhz=}?3N)JB zq4J+9gHN=s>w6OoTk`cA14C3G>^!R0g2le$gBtFIX~`Sy&+&R?17r@%Mp{4vGv z8!(_cEAZ!g_DwpVk4N#TZ+@AZ+1aKw{iMwL)cx}!+16!r3K?4Po+u{>Ws_C+bG}JS z+Nj*f3HRh2SOW|gH0U$5g;`A7{{kBj`JwsbQ+T&yK`a^kf?x)f>bw-@@AqfEJ$39O{T_SgZv+@yI0Bd8N?6v>WPG4gNi${(K-N??vXRaF;Cz+(w461~8p zbk57smaDU%Jc_C8G$ptT2ra9{;S2aHTV(LaS+h&jKvnj)V&u*y=ApCA#-Qt4-4x7^ z6#$*5s9M(s5amw{gQ*Ysj`5V(@p1iI9g{2qP%e3X#%`N@FRgcRKO8Q3`5+jJd*Afs z+o<}s=IvNlStTc9doJlHw1*R^fOYY>>q| z1~2o}HWNC!WeV=jT4Sg^qYx_QE(856GrFo8_XzrS=0Y_7c4V4MetaqRRa(m?Jez7~ zyowQf%AO5@T=EE11s7H|On^r#V?@g`ELYu&UPVl>H(&7#ULxh^XUIA>m0jZ&_M`gd zMLaF)FIO30p4>Ilnd=(gx|}DddH5)5N<>sU)N;QBPKNi(FK#*1kD;LlS~ZAZOlb^} zNg>~OLb*|T(kkAM{v!H}PBB|Q{f{$u{?dtC^59AP&u>B=_QDBno}3PjIo#)y1PaKlcGZrK=y@eBns+JcrUbCr5CSL(G(xqq7QFeMV}B+< zQo&Ew;%2=pNDD?sK$tnVKfuv-2dXPx=puCQo?LK^j|qL+LMFrlu4(UBU&}^DIw@xK zi;_&OoeR@EAvDH()&wbFqt7|q`39V;hbDG92MtXx~sZn!6^CB-P@W}D^t3k&Da zQOnGR2YCb)q$v?k9f%dIay7)W9(7-bMBLpM&PYE-pCfkWIP>pP)3Tw!6|A9?4 zy(7usO>w|OJ}vdY--x61<0;oB%Q@M}e3Cva>v}wq6}6rETJ=o3f+n9r?ZQJ+$M=mssQN@hHo0GjDEK83BXhAb4L(^> zT-NYkXy+X4!O<4ov<5nu(<)9qFY2L|wB#8=M+?!B%mxWFzm*en$@99LZchQmkmN3O z$2z4zBZ}y~L;7m4yo?ti%lW?2^q>Hlw}NvOvJtI89q*;&>k zMocQh>@R->rmW#h*7vNbkpaUZ&=PB!M$JPjDXSRDkJLvCkb>;e5>f*OE?pIyQ(6yZ zRVp|>)1QC1Pj%Lz(to^<{)Nw?4nd=4X^`81%6E{$1n^wxg;cpV&`&iE7 z7;bsQS-_)tq^26268G0;Xg*v1PiV!O^ace#Pcd00)Mf*hW5e=LrEL!7ETGE`)MPlYkDMd?at~_9oLm&-u8ZLhwN9`*2{mK|g zs_~}wFp{bgKpEdaxhsjG;(9A&efysEQlJ>%KG}IU@Hxp*uOaV7%uznabwxI^;@h2W z#fQ_N5tAYVmu|IH-d1W}=7rPIvN%3u9xB^~A;3+#ai;@&XjDFXR;%1E&jHMjoG@MA)H!F!=|XwVua4<_*kW&s$6~Z5nW&* zjM9Hj*Ky>!5kOoJbpI#`#TZ-L4>AKgiuWP5!CcK2LgGH7LE-))gFFY)mq<(q2p|-g zuGs)H0l202nYWCm)>Uu62*5_1G_>Dy{{V~sPXLLOUJqdUP>DAApNZ2bU8O_~DePmv zF!=EBOm%NCupE<%{GlIzS(h{%j9Q}VZhrGF20T&lnF89yTV30Sz zfxP@{!@NP{f0yNV_}-_aU`?_|GjbrsQhiOut;>~+y?ehYz6V1)cz+Gn5OPdloxL7B z$M(7ZcoC-o<_x|Ty)*y&SA?s798pmswxQo;B-2~1?YsgQIf1i`0xF=(ORfjL$Nn(_ zm;E#3hdteGp`YTIl82CE-K*5Gl%xP)LvTG^yINTv&s;r<;DO30# zACig});l>lxwf(b24x)k^RpJUoRR;dn2e4#VE+~H|Bh$+e?mmSZ3h7n_qCZC_zCjQ zs%I4wH8U_P<74nYDbWp=9XDS2qL`GFBCr-GQ$(H;e?M1dg;vc`NpbdK`{Q`5(3`8J zW%2UqU!nu78HpDn!UCpuwd*WqXJ&+6Z_xQX1HNxj#wfyQ)mfY-P>g2#T}gj}m`v5r z`CqmG@MX;U{9rv+!+^(muuOCA!_WC(5P-FAWCV{G@b^C%r7wb823*5QMTeD)Y!SiD zNtv*pf&_eRXz5Z({^tAb@HbeNvfWRZ91X0tswV@StLmz1yvt~83goamuXat0D&6R7+~}cEDTy#=L#lleeX_$ z!~dhx;(ihaJQ(kF5d}PupcC^GB15L8>oHmeIfC`8jg2?KGR8q@5(!e|qNz)Ng2P5f zN0m*s>9EWFH?rMFqj+d(NV8I6Vq%K?b=Tj$au~)GbvrM6<>}OiuEKmB0x!Q2eTNUC zC?3~s_)6#2WM9VNYjsE9eYVB1Xj;kbxZK!5Mikwzes~=@tvbW{Aq=!vmxIp=#c=vA$sufK$D5GsSVO@{o_NvL)gPcV9;ZDQNCOzE|sS<_ZQMktTIjAB;G|_i5{XsJ|j+T z{7>OdH9D0e6P9fPOZ1Z_VMoCyxdQ(LO+Y6*0A8OH4>02KZa9 z`5ada68hR5P8Gtcba{t_vUN6^g~ZESq*QUU ziD!HMx@&9g4J3DyPo6?AA*fUtO?EX{mE~ib%QlS;0h_0L^$oFaTb1IxofVt;n%Ul9 z;luB7IW1e4hC-bwi!zpjXCRw`Ku^aI3~j-O$_Lavc_zXcC3)zo=+Ftjr z=J!Upe1i}&i!d8OugBe3yaoBqV)eDI&9#v!{HzFlXlwhYlUpiI|2coc8ccLcObgg& z-Q~Uz^Q~#Ya212F(al^c0D#{@&9>MvNRgo^M2W7%jBo$Ccr0z!1xh~hziH{o>n7rf`ww1 ztBxvC^7lEOOV!KLmgGKliq6i?2HtxHLT{ei9tNG9LzT{LLH@fM% z^VA${*Xd+#R*&xyX=n&`K6)Ozo$w15BWqgAItDxm1m6`O8#-**!ebX)R$$3~NiDKg zU&@SF&IT$!2HqSXEr-u;4!C>bm z3<@Ip>3?9ay*z}*6y>~4{$TRj@XR=8h&nBt9zIdp92s029rnH`2C2vY$1bIe`(xRD z*+jEfkT%8*Al!_i1F`QJzs?E>8ovQ@U@^UIHTH9@h6Jpv?HU$>*jtGqTQtaEZV2jq zifSPcG;Mc8D0$K2#=6-HXF*Sw+xO#!?O$UkK-~$>eS<8FpY^Z0sMvET%~4tD+UvK{ zw`0+w4T&Cdu-DRk#72QYFo-F(!RNL!6c2vM=Jh#+gw|DGcc&1nVjjDdMue>`-J)E_ z)a4&V3bkL~#b9aPH&PKIIQO5?L}4TUbkV|vDVqOyq{U#wyi}#v5>AeSH%iMTc>+7fZ2)mlZN?A4bq&yZBI5g|*{I9}=9_HWnX5D=#QA0hu zoIuAZ;)?GM{v?&-G;)b*Edz~q+r`N%jS2D=W`oc|9p}kNudiM2uTNSr5%zxfjbWOB zV@bEx?z~xZ)mubFx+R0|6a(yUAEt-JA8-SnFN!Q)^Q#05Nc+_jVvq^_EW&nxnmL9g zJ+~A-vxC6QjQLtww}8tF0>zW+%>myv-}7Aj*C}_3^BJx(H9H!k`#H-q@7$68lmh7_ zG&hTBKDo4PArQ)GInN19)*CE%%~mA2=MzcQ!?&&LyD)7SII)8WhRNXSPUo4>G*9i% zsF;XzjPddJl|DcVN4H}YB(KyGbIkS78!g?dXVEpv3Cr}~+R{oC{d^jaj@I}+{b@Q@ zi?ZePPoUQ0J(sm}GF+kwHSG6uJoLyAunNut8?&>UR&uKvOIP~?IMl^m@%(%0MRprS zok;FCLWp&irsWDXT4j@F6ZH`BSgNu(h|aB;AA84eWeR@UEnO+g*U8TtlL4G4{`ehq3HtaTz4H6fK>8y zY82}3Gj4H(A+7FR%XKlQbd!39x0iTT=luCj$j*H#0A5n=d}$n28x5yqPMZ?P>nwtn z1Cq8v{~gJ&al2avL$jgjw2F>CsFdtn)$0)b)3&=?7;~J$7E`4Ca8ApgR4N4p`#AeJ zknX3Q@cMWVuu_21xBXPYmev9>P!{a2S$KHjk8!#5Tr{bEp||HT{8hRxughliAndfU zWd5YkF5h*c9P_tJiqHg(F0Z#5ILvI-_RaMr^aZbzjgDTG14{d>NB= z371p_0dl|$n+FN|q(NQ&YdMq&e~k#`6m@0CwORXO?5}}_~!W!%Y{UlM=bCVYATsn?Zi}>^-5_`{lWPF?v?gKM}lb0SPKwniQ z1*lFIw~+QTWn8|$%HT)9^MmVg&QFzz0Z2J&;a;3rP)2UtrI%jnwCLyIOUjM18J7fv zHl~ATXd(NbcC($9}NlnMWAg>7ER}KK+z+Ew?g~?nmnh2NrF0IV=8n?gzAFTC8JU z!M9!Xs&u74p}tH;A;y+ms=qDFNVB{4val5j7{e=x$1UO68qx|5^DW;m$voUc`2yen zY!^;t!sXl8f-rn)r*@3|PX$S^Ba?q$Vk|z2lWO`W_8$pcBcoC#40%!GH+L6^c|(_* zwKCEbR{Y^)FXUlHg5KWd_ZUO`)LricLKmXbuZBoiG$#)(V{B_p;&Fbzb$kzpNc&0} z$_CI&H&5%`zD!`Ir!X&C-`{6$UMbKLg-ef_x~X;x6(jD;cVowZ0m$nI5IF}Ne??Q5 z-mNuH_7o7jldsJ$S_G?#2r$SQCt!i4@GnL4N0+J}!?Ew$-#lE0nW9RQGv4&Px)OI} z8+0%gJiyY*u}$o3ERt0!49|m9hNUpabad(mCL#8Sd^Y8D^ET?E0k2&-Rrj(}^;ELK zJ(Uhc90Hki z8+vfM6GIFnIw4{((_3puw91qK$A*-EN>-NEu2(L#h>K4=ysMdVd+V7eJd2^_05(g; zv8#21rO|>W1pUu!^WGI9rzjU!(1tUar4!fMHjV8U6TRn6eLfBznjKx!U`O!mk$VU) zMa;|ixzN*wqbEBHg}F|aK~?et-`{ECb0lGp#%&Li;iCQJ=2Jv6W@%BAP_14N=YC}= zHle?TEnA(piaqY)#UG+0Q|B<6X|h*D$M+)u1EPkCdb6E(OyK@Ahl1OO9s%9J#|d~{ z!0raEMQlB7SK(%46PM#Dac_XFsK000s{EZletgPmReN>AZUVvp-CRmaioT(S$7?&i zcy)1WWlP|Wl`%g+j}kpf&DjO>X=^ufBxNk#nVYp2tm2G~xhoBPBNRqn#BDmazm`Ev zHm@;H8E4z5{69)N^Jq4=Er3%U6rF=g(VJ2=R1Hy0ifgF3C8kzOjUk~_V#qTG<(jI3 zq{LKeEQ%6SQ9})-5^AVYic4d-74sM&FV(y5dUw6|N7sG-ee0~f*7?ppd+l$Zz4z~Y z^v|^@*kHzrgDHSIN2u=@KOfLgjMK=VIB~sgrI27zb$G@wF~I>sOveK*KnV3JDjv z`Nes`Jojo_gb?=P=naJy@hC%9R(|i(MG~1=ySt&QU@?yFm_ujIX=a%vTrq!1(6QgD z8?Rq4;^H;M&}WNb^Iqz`C)muDt*i&7G8o8TWjq79532kt1nYg1;dohS5dpyh`=KUE;UNR z5BR1KfnM10tLOO9LsM&E!8JcnA2zgI=J?g`XXyW6r+y;W@OKemJPN|b#zocBR5$yd zG}hn6|6h?fQT&|v_wFth+yK%OP1w&Lu*IFtv|y2BtW)Yg1Dk$=eflpE^nRM5o7#TP zd^BKH+H(d-(C4jvTXWwKUjY9$sJi%hy?Ql8PQ?ZD$9!%yLBr02D~0dTjnIYWypS=K z-RU0VQPC*PeM~7hYIh~6(SCt=`?ifR)ZU}cYL<%yCLIe;`&LpHB6=fLad*cIaY`(o zQsnah;Rj90i(UUD{L)tu;&8*AZJ*a7^5Ds%Zkws7hS(CH6Us}gUmce740 z0W%i-L5YcZtx~FGE0a0XngpM)X27gCSJa;CeF`%4=Mwt97r{p<=`IkD*083dLP9ha z8HI<5m;yiS3;cMyIFo|f1O9Bc-cmgZ%w}dwB>`3vLKagM`9{U8&hYOUte-HGOxDi} zSfaMF@%pMZrM;0gzc&vyRzdZ=nh(;mw!_s%l5}ECoh&ADBhUL80k>NB=;}ZN(;p33 zTg|Pc#LFEfvGtiP4O52rw!WL1VyO{Q-GeR%7pi2A*KqVJ2B&eu9+{6RzJX zXb^41JN~K#Ct&y(sKkDwqgp_(oeu7GXe4@TvZ5kp+gE&z77xd_f@5TwF6>RU@}`ji zSs4ucA3(8Rd$R{Qk%eJlEBO@2r-gT{&t@ZeSCwLDT(V zmG2m|-YI@#7~QHVrVDvr-j{hI{A5 z27QY8Mr76@@6-z4xM*Vm8w{@h<>Z&Tp7oVW^E+99-s0-_e28Vll9Q!U85KYEBvhPT zeV;IF5Fx5j4qkT6QR6w|>>;@ppaUC8GCUAvxg9=az^FS)2iym-zqo?w7T*qQC&=w`8Qz@yh{FYr}nALGh;3l}uwTKydErP6W zy^H~4SEfY&Fo2QHUj+VX67GkR+gHeEO0(WkR5Zgn5zatouUC~(64LN7%t%VCq-4Jd zVu*9|9(Sa6Z0hAII7sZFJ2J;f^m)UB$6tC7GRRb|9JvR52SfQ<`7>WpX1Fz-08p%g zEaG1_^!WZUw{YZ(HuE{j}pavPQ&#klxpGudc-q0g5N=Lmpbg9-IPe%H4% z45jUAtR5|&Om|A>`Qam$G3Aux5nAlmBuYA_zOv`Zthf-=4QlpLCoLJjg_Hpas%(p_ zzWuW7NK!#hYlg8dY;V-hO$OaYPE%(Cr6Vj1TBDNNb=N?K1-1@N5r}-W)+l;n^kZpD zJ~OSAA!EDY<_E3!Y53)))Lm@qTAtRJ`Iy6*(YVJxyN=!m2I0@x4?jP|azqVM7301G z(z;!yQL@*+9s|W|qy%8SCp+R~T2B=L9=WUX2$D9hVk#C2Pzzj-`w&YqJ#_)HqfW7r z9=TnlS7p-Vq2uiN20BV#S}q*2QK4T+OzfQ69xlA4-2`NOvr#T>bPk#fid2jKKzt;4 zCpuxWJvpga?gt1R;QjX3E?Z4GDTAor=>GGd0<3zXHfX~BtWCVUl#K{A9gh9%vPc4H z8OLH1iJjI&-9kBs9NnP|6CME|=A{LIUkb5gEKX=T)+Kh;b!?`1bvbD~gWifmj^4du z0fE)i71!I3MccO#3oi6d2j1Y|TCPn^n8`tVb|FVCf-!+$hmA{)gzg%6lbMQ%@smyh^KkCE66e|9@$%k!%G%YnU&nBVS-0ywvEVD~4*wS*i8-dRuW!O3!r zLRqLc=Lc#ekcY9^_0A8K;@6_X6}Jy)C` zg?QeQec0*@1MQa-&d4WU=Lr`)XxP!&Nt<=b2mqFLg_ZEQe>VNmYajOO?i!vI7_f(& zajUW0&d=C$UU9A+QPnmNhtMSUzc98MtZIyT0*}g4Q_m^2+2$kHeBLw^7Rp@8Adi_l zE{;d!DOsX;N%`W(A@v}TxQZXh4X{wD|tW;U{ ziw;y!owFoK(7VbJ=+^eid504vsa(Ma+(U79f=jVLfZzlY z?DF1wzW>2F=k8zD^CYvg=h>f`HEY(&M0{3Lz{jP)ee~!NzTzi2%}0-(@;`d?#Nox0 zhffMxTwXnT^yZPGoV2!A*1^hiKj3z*)Qy6#K?0NVX->^1L9DQEd@$!PMlRb#-mWJ6 z_Rlu!Q$U~G)TMJ%C);7XWpHjt3UEqOm(CUkpN%d`*b>0fuoPO1AJo*`ugkv-^jlidw@rIFS_17zz1S!;inH6PXE8-W=6yAbXF@QC5h?} zm=4v|jwvM2rqD#1In4Z!?|Bz+vDSsV6<@w{k0mEpuo6;65`WU_^`akQTEe6!TVUK~ z#?T6QT|u+CZm-wjCvId%E3W;nWlR0P?iu=>TG8nisbwqNCl}r9Q>!ES6BSves!Ree zRh2d*U@ca|@qjNsQggFgQFpDygj4kFOEse(9zFV}9L}N6X=Ip{!p#uc-P+K2{i%+K zNu90TMJXWzv>I5>SElcJSj(Vu_~!c{>FxSR9on=5rJZhmVlgg$e=N>Kw-BXAYU7!r z>Zf0$=j?N1I!xRH64GA6c}cIy8onYKY8T9+nl8m)3fLy>1Gn6q+j8)2Eu^%!LEJ-(!fJX>2`yx;Pp&ONwdCdmYE_lpl6ZW0$_IwH{ZDJ5ik2{=*N`Lps-C z26fDpzf8^?BZ{8K6&}-(R|~{DI9&qB|X{irS9nSc;>|eQ!0%8|rVV7;ycq);Mn(qJt2_AFSlO=W4mY-6xmo7x z$y}4(qk%12t6Ei3{)|?)i@jRzJsuuAQR))yCCgNjc~h|05_M+VM*gLm2Ldp?)Q7A6 z)(5@37BJD#U$TF9)FX-soR$js1K$aqx)v(8j)i1H=2b328Gt5!9$E(b`f7bPCl!Gk z5%?T<^Hzwy7zb|@g3Ob`PxkU`0ep+8cdbo^k6u=K-$Z^-qfC@?w2MS;i9rl3(`!34 zGMw+q^BliIaho&thR5rzs|Ie2qMknbiLajSe^$;`P`}a5kgZ!OE}_V^abiO)$NcH< zihD~N!fj}TvT)PjCrcb2dD$qE<_^okN%DHqKshXvm487fC1vaYeK4VuoeeIG;DZVP z_w6i|{}K}ahMkCpYnY-j&^XL~gN^|PJYrY6gb zkzFmzDL;{}^iN5=o)?(r^*@$nlA6?NIBbRXbAkTvtgG8|ln(=PKdb}Kt{QZC4TxPK zUYpTj&z;>@R{%FURZU0VRktl1oru&s?o+3)X*h}lZb9Qq_@3fA)^k+>chO`itk<9^ zEAliCG**n-wE8u7c8dA8q1z*wF;GgIOvfZ(SiQRLx+>zXfE%o zd)#xWmd$vsXKTN1Zx-BmJ;Y0N0hifg_9uyPYx6T1*^olwI(Or8(;z4NADN$s_?|-S zT^@a_URO${2&r=KUw|LuTqWiN@X8Lm8jT(8>_1|#TfJ!bJ30g}^79i_>yyYE;tFA# zBb#O4mZJ1YZqw>t-*j8?oVdar{C@?;xd=9jGWZ_8!p712^~QAN+t=?tAI&o}?CDWGR=h2prKK5hKX_7@!E}cn>+-p$Z{OPpXB$Ddta^)ixz{ z{UeEGas~Mt{{lS4mqPMV2vVED!8Osm5)#?*ex$e|<+=?oY#BE`n|}m)Cm^R8i_~)hS^!dYG~OrQm#ozk)zu-Ib>}Er$I8nZSAa=}u)Lh1rz9_j zgu_r!;EEBgNql3#Qp#z=sovby#~ij6_O=;eh|;Am54@Ekxk#IV2c@%E4T4 z9q58PP!8@xi~WLs21h*hk^|eVI!6jG?=p--z^fMO<<#RJe5WN_u0{%_uEHX2IhHk) zi80MSs29N17Ef!-anLIGXfrd0e7vot=qg2TER@V);ihVx1td{ZQ9pW&(rN^7;nEHT z0q-v6uIG~@imObFeG2WL5f@VCykOy*hCD^(S=Q(4ptqt zTOk}Tr+8^)&xt=3(xt*EE1k$2lh>oG0-A?3O&EOm&xyJB(4v0NA$KX8DPKq%IwyZ8!46P|}kO046h#*i}gU{-(vD3m#WY>+P}gAr``FbBh0oIzQ#rN3#Lr?9Hdto`=KP3Vxf+DHF zN|Cy9++>BsnBJ)3k2E9>^H+M%d@x2=`0-ikX55!vXc2ocBHfV;lhnVFkm@uewES>`9v z=I-tauC6;%{SU}2mL3ln#(o@|ipJHItaI7yK68_6w(JgVUZMdIRrtZH?i;x;rm*Gm zpnbIQ0Z6`asRgpXG=VqBsLifAS6W{*`ncwSCVaLQc+ch~pVP}LnFbN~!3 zv4Hl5&8;p9HLdQnHua6#@hpb)nJH=ffUH5xlclV)lA=8rVPK$Cxb+Z$X=THGi0 zU(vFgFWwk^SNY&)?OgB#AG3^lr_N6L=8_}@592VZDt!^OaMu3Z^L0x~qK8<3tAXN% zmEmtroudOOq4znQyPzj^?MmY;%zJV8SvkF1xvEyRJ@;Hp1%5=d*Huv+d#>Uh*6J9iwk?Uc~T{P&KX0?J>SL#Sq zl$S!cFwK;@wTK~KR7F3;#|2dHeApLww|y98pju#j(=$Bomz_Ov8vFGTrB~6HTRwo) z@|*~IKf(tlB;pftX$xy~eSFw_yc5lO=PeSF|2Kq8o& zOqKH#`l+8tk)-WQnCDLtiddF6_ApJ8R_8DI(#2+HVVk?1FGR(b((20HE+U{jAfg(J zTaHWLA4Z0fMqMV&gUOK?u+cl>f@>Na67k9p{4yqdVLZ%;ip{m=+cwfY<@(*eE>?Oj;!_o!VsWbx+`N6ns|+VMH!0o%Pkb7bUw zxjh?SlS;<_5*8>S{4GLL*U2xy!i(Jh7G6vfcmloz)GFkq>6fYFn9?fwRlv5_W5c{w zLs@1+!#pDD3OVMS{m}KGQ2bd6srY~kB1)kVlD8gCKBy7}8m}8z_v*1FcB^9sZg*g{ ze~N#F$t{;J2lgR zMiK0;QwOb1h9^irr_uC`hOdItWNMiZ*6k4WyIKFu%(d*)(wNa(l;he1-?hcjC^(>| zHXNeABt0x_ed?u?C8>zN?%I%0$ptDaGT!+1zqZTO!t`}M*W5Xp~yFc!} zlrpokt)H$-Dz%u?`fVZqKVE=CsigUzY3A0wJzZWvCe7%$WaZ7*woZI(eVYG0(YM2yMvVrmiyD8XZvI@; z4=j4>RgfqZxHBkqMB)FSicj#cBIs?0Mi=;q&2z@BZ0*F+X8tTop_aC#V1T~+zR-2$ zY`I8VH_&f00an)2vja{O8%Ng6&u2|eFES3?qDH~cIZf}=dE2EwS6wg_1F)W%!_~>i z(X!z59QbN<6Zs=^dl^~m86Ks_Y1mE=*4P^KX&84&s_c44z_>N0&z~qcx*B(I9{;1b z3MF$9SAQ~peRxwiZS5zPxl%d~n_kqH7JL73xtb$-mo~DRMnc1N^T2y;nB+MXS8}$* z=^LPAfbwW@bm18pXF9{bX0BHpd|jTJ6DuwI@6t_0uf+;^VsT~cDy)CcJ{%{u~E{t+WtEvQ&}1V(cahZM&L&k@41!a zX*u8eMcq}00jPrnhjJZ#Z(?+P$SLQS>e&`FytzORdSY`c(OnB%HIm$)?O?67^b zbs;RT{4E|K)w;9;o#|3DLuMFRR26!w5>B^dcY9Df3m8?r`eR8deZTd!35~{MK4Pw; zDg-;M?L7D|rv3;1V>O(#_!OqEyI)u&@zOd{;^F9M>5j%Yi-L~}@IwT0p$?5x4^6+> zhjT;$+H2)h&t(5vRf+%uCJ04YWWo7bz4|_1kSd*3hGwdEs zK3>WA5C4Dk$o@~dbCvmDnWw7m?d7%Rzk^6Qc8QUDsj&*oRDs^^k>PTD8lAHD<#Rb;5e5b{sk{vMeU_9z!d@i zl|0QYk$8+b>XXJFpW7AXr1M-wH_KtcAL&MT=2mtnH;nV(Q1iX_8iTW5AOU*B2)d1I z99m$sW{si}pd35w5X=1YxXB$4AB6SrThMc;<@!O!X^zi+iQceZg0}W&lf0yFN{*eEMJTjv$tFSTv-njAoOKxV%)_N*LsH)jnt6sgp z^!kPpu=$6zA?~AzEVD}IH?9mPV^I$gIS*iOz!1HAKrPpE?MPc_< z@3s{#C7{^ohoSK<(m2yewR+yo?yRUW_6qLgWlp_B!N_gguHR9(_$#~B!$nvt4Rw2S z0%}aolxM>PP4#lMvpFmwza`P zm+hE=4yP#o?#Y`*uWlkwg%-8;huta#vhIgx?^?^*!t)W=2c^hM*tsWkzZ127vt!S7 zxi=@(!Na@Y;c*rfM>!@n&{arFt>0e5u@wseG#91zP1#(=#8>2%^D%(ba=D5lyJ^?>sMt#wIb)aULp7o%`oQdrzqQc0gy8y+2dla zxR}rdr7GpSu|&YRf#lTX0_U-Ao@|W=^4w?q~p{r=!|W^Os0f6d~Z@Ds}Jc9A={0 zrFFa~9!|d33krw6Hy4Ue+~vY_%5FH_v@!LzPpde%Db#42SkwA3DdI9b9WRL<>NZ6vM7 zzv0hTX?;{z=t{P<;57QMC9c}PpM2zMU$){*yPKnG+-!C`Hk%FYeP9aTT}M9R|9p<^ z*4pmxlfHJtOWS!5gusE9Zr&((KlnBU{&t_)~(z_rodjTfcj; zA6USVi|=~gpe)vbt#Q=C`8?j|vX5nm*4qbf)QcZFX51Xm9SURHR$n=}Qd_PfeHb5x z^1$J@j-0I#E!Tr)(~e<{4i-!Cau3uny;9V}4MUZzt;6o~4d^S}Ld8DhlK8rHG?bnGOy!4OJK~%q59! z@s#kmSJMs-P1QP@N*`8`4o{G+t;hXzi}z*6d*?58`fL7U+|r5q&7EQZzxw@|);OdR>n0+`ry)Ts0rBzVrUTN zR;!z&zUv2e1e_qjMkP28ywEGGv@Ivd{a>c}7ZzTb^8coq`&9o2V$A=MXvaO~Jm{|D z8AR`Jf@0Z1?;G;x-(@=5-mlKVtX{_}b`mgI!N-QPH8XMv^hdMrR)@zcRJcvz#~g*k zZnu=>l5~U}Lwj60Jwm##l_>A+`{TDs$;e!NGqS%cateK?_f%R9T0Y3bieKS^7$*(Y zXK;P5`ll?2fLJ}c!u^+sqp&}Xm`+X=9K;sg8`Dm-kI7d7K&4kTJQ}76+AnU8vtMFb z_M?pyzNrvaYHR%>aGRxCas-72SiR6ZEmCEO_O)+aCSyVQI8xXDT)Jku?t1CwNglDL z0L{Qs)QSY10zLISTdwc21f|AI4Ky@%%uQLORp8NDBz>ikXOmZpE(LpaR1y0<5xDtP zsclPoS-RfIYOHB@>~qD#$ve8h9zk_{&iMYKXWj3#{-VZk^&8)w|=;YGBC zMhBiAKED2)tbWKQbDr3%0}1HYcNPbU7^mlt!aWk-j8z76sE%@vO%C>GUwKFBA zlIS8MASuZyjAW-bY92nVuKGk_?*x6lV`j|pKUvXN#|_ULs=pQG>O5wbuNFy1h?J7^ zoOottstIH`Nayg1+=pV_BTCOIpeB`!0Rd(dww0m?<+REu0=#KbHRUhlbLg{B=CyxB zZaGG&JbcDvEH9hOi&8!~JZp4xt{9X!W!{yvg{vx)89u~(1ScWlko>ey;{W3X6fRCo zY~fVJF(?iVaL%xi_-)jGzyqk~ zZsA(S!WubB-jMiFV>VhOXfJY67v-y$l3W7#h5hM?hyDKBAJvHnQ`f(X-KmoTcoD^g zgP(0rj0qdC7JEh#lA84CPDESn@k4z;p9{vaASF8CgXdidMtc1vXW0!Lbp{ia)p?ZK z@S0lWt2T0TZ9jCcQz%xika47d#*W_J2m4Btu(3#jz z<}m%@U#NW9eJjAd$gMkJ-kM&#+UOy!cL)YD{$?3AveetRpySAHY%6n~w{ z)?x8{Bp8cLYPa6l#&r4&@kraSvXIC`x)8L+@>fEMyWmSSQt-8$=1Y!&m!5U!zgEvq5|fw(`l7V)fIjKd7FVydytI;9 z_kT`)c^y%w_;wn6ei)e%`t=*ZFsypz+<%+Mo)@%D%F4WlR(uDWnHnBoZF@x zcADN89UR1U&l0xUgAXA%G#OuB#Fde{8SkDJ+QF)+9Z3Zrv+|iYuc%6J^J2%swe0RNnaEHvdzA0Q@f0z1fV_qZ zmeWP2v^`5_dzID3*&^02gNIGuWY)hoMe^m`7Ys4!7LU)6g)8=IB(80|*eWr%q~@-Y zE7`*QpifR%L%bLyWbCm9W81z|(h{byj{#;MzEh`Rpjs@U;1_~r|05kst)qR>;o4NQ zRft`>-Y+o(it8yPEs?DkD9*@|3}w-XdfKT>#yO&HC90;QO=;|wLT>vzHJrZ|7d%sm z7pCs!&D4^RwcH!j(tbgTQte7*wmm2wgGkCJVT)jTdre&RhI6%E5oSuVFmUvn7;NuR zEBgx!`MOWU$6nWp@9jK!1hs=6mkG!Q6qmFtn4h6J;SJBogmgcudwEx%*rk_U{ESxv zQAtqie5B2$-+5^&yxRz?H&`HA{*@X)8@|npQDx9%W^}Dcjz(s4_wCeZ3wiQ@ji0FU zwL_VIDB7>pFlP2SqsIyn6C^^?@IcXfR(Bq+=MVw@K2UN6{;flB+K#zeJZqj9ES zInH}uUue6?j9Gcab407AP74SL2qPl7l0#={s+qH$5{zB{!eGmPpJkgg=7$Lm+Q_%% z_OmF$6ql((OSw~*b{y;++Ww_l*;wjb(~y^7afelFXA311+!SIPR5$c#r3SxjfhbbM zch66m`c!bOLJe##o&0^tkO3FytUB$bCv|7s-~j10J!4oOP3HKt?cV$6;f=M0x&50( zg^SX_@GaieG>=S<7}aDRF0POHVK^Q1#u7w)V^woz2)A(llJ(m-c6UQ_`x^9smC2|^ zHRPA**{5ix_8hfhQ%*f4Z<#`+zxu|nVxyt>gpA_xoPsI)h_6>+0D%qPP^h{Mx^Zfj z!tib^w2#?h4g92nTlc_50_NcIUeXn`nSS^tn|>3ETDKU|$1ADMo*Gi#NBS}89oY*; zr524^4x=EWO8uVKwE7e4=YBC--!!Ct#IrKI?1=h76J_r;*QT8uH`16b5|}G+L%iv- zn0BoEVb0n{sFoz=L_1OS*OV=`KlbwEtV({)lC7kAqSb&4w0T%&zl=M7lH=C}$y=bm z0LHg|yh&;}Kal%@TH#SgvoCo}n8B!dO5EybGjWuW4kIZ?t#ihM$s$>mijtlW&BhM9 zS%q@+$#i}I#Ex&e2#XUK3tJyLAb+8=G$q3(61Dp#?JoBdgQ-<3;2eQ;$GtKE6J)zp z$1;-4ALcO`3{;Lp0fG+R&!MMXYeY{d1idv&K9_Q3l+o7huRIC3!ejh*!TU5!{#rM3 zD$!;wk@J+%g#w|>i%D~*QQ-V#)YW)5o_%g*;CDNpP`cA3NXkN@D`K)!+B6z$4@tw`g8i(gBDl0vPKOPeKt3 zi^Crme^uNimX39@Jf%~Q?Tpuqdq?)x4+jSvs7~!Kdn%XeEui3j@(Hj|zOsjFo8&?W zF(j<1^O618(cL|&F=QT6*EnZxMp+&ze^0Q+=YaN=xGf|)ZoZ+jy_!G((@uOaOYKj% zDcUU0--LHt)W@G=`P39_iKs|aoHh}*Xmn_fq_y6*=bB8H;MLeFVz%F!oBUk>=iX`W zcva2OT=4B4I*C?{j0|($eUw}~I;`X)-#hp*H@c1!y!@@3XY2HdX#6<-JjQg_q;KD% ziIC@3?)m%|{^PzE*fP1_iUChTd=TIJ!MoRv4i~V2BbfB~f0TszkCMzQJJa|u)VzLA zZZpnXT7alokLY{NmepV5JMLn!dgP)20|2s!6Xr6i>+Arw3##uJcbcJm@@H*U26fG= z**eWGtf>_P#pxX2zOREPV@&|d#_-HeI@E0s$=AixEw}t7nYeiWs)5pmkm9qi?YDo`YnJP~ zJv*=2*>glyAsk@$COHFyp+z<#;cojI$6r`Y2<@sm^mmnUFn3xWAlxOV(!S2C&50hs zHKy~@@L;bmL|#`qO0Sc&D%SX|`a2SruvFE7IRlTT#Gjet%VrEd#z9lb+$WTPKZszl zy)y6gDZC>%>(Z~1MwX-;iYfwvxwjtKbeS-gm^rJj!9S-(;lqgx+km!$8(Dt*7d`Ym zVZqaMrp)U^8N}U`MQrc&iW4K!NW+$Bz9zaE`&9k4cMb0LoR~E*omE_Osli%&n;M_J z-?o+Sf}M&^^EJeWRh-wdMyRUKks+ozNuIfWod|L(M$?zX>HDRsY!NA6<*U7pRN!0C zcP8OY!R+B4>705?4(Izn%yAADQOV_>h22}p#cI=o^rkX(gmZo2eNE0zKn36@9X{g7FmHEc8MW`$VvQL@&*ackD^_R={c1&9h`I=p^nOgY=kvQ zUBk}i{B%{@ZPA(W>7;;2&cBKMtVs-YpIy9{7;wcox+{mnBqR z1%MMi4w`u~(D6tgBJIFGxl*tsxR_)0Q`345Nfc;O6M8(2cfqPd3!YVL>-dVv4jp`> zze)yiTy9Mn^XBUiIBh9s0%3M9tramN1>~Jf*R}^IgKmmA2Snn9%yiH|1DaGx+gf3X z!*@%3$?vlNB}T3e{oU+H3QLn)>^T8GE!s* zcnop2VC`TvoMO(7-l6c#4VW~CBl}sik5O0COA!Q)v)jK-D)VItZl7nwH&iPw`Toza zc|#1l0_w=ChSx1@lz0BT{;{+;N$?q7_`7f&8#{r#<=QE8kVGF!-A&eNhVE zEGQ3bU1dCdFQa^$;?@7`z4cQk-fwyL_iE-5RjOw0sIX~hl@^ZxdEfO zBG5u3s=rp~lZ&qppOCEYH-Bwnv#`E9sF$f+o1L6Mk|rKsZ4d~pe~tE8UEa5sFdb#I zA|)Ab|6Uo%{SQ$h>D-7fmSZv(f@iGQ+-s_Q+CtukyqJF)FFY^iz(UE*y zg5^~dEb@&Yf*p)He_x9@RMG?rkK)eA`>6iOFDeboxdo1qZ$-Jf;u`C0ON_+bI#i1F zj7M-FZz z_ieeY`ErESJNIidXfQL8PO$O(T);dUW%m$!>a7M=^}?CJ)!loip)A2|F-}quBrTY} zfM`bruD%wnuB-%GzT#<;CMr_TcL_3SIiXK?ri(yorj$^_+QJglPqtG!q`SyGK9NFG z3Fp7P^Ek_m-4~5Glgtfn{_qX*0L!pN3cG9WpVX-ul0T$1j3S_{+^5YaKo0v1uI>$d z3lSaT)WmeCo73H2ScahK+=-oL-gr9`gI|5o;MadaRtKXfi{Dj!$0pR5An&?yY_VN# z25B<4x6hx|KKYwUsZgR#NKW9(@J(EOrBDyvO%_QeRx6yyubZ`t&g<}M;z208GS$b6 zrKw=W`wUH~IBoY-ys0#uJ9K^gDDjmAX(%D91>?FPE=CLv_#ZDIhF_3L{m>rK1yD7{ z6OS-te$gRj`dzkMmF0rZI)HdW3*B0 zIQApI+`IxHpW)YF9Lz=@c?0Uq*Rijt@7dhdwduc7mypQ3E(fmb!XWe>u~iay{df*}^tA`XP}3PEfd7&1F|T=AvI9vz3sG%`P!YY#^P z{s;dz9u4>(PwoHyp@jb%Plot?kK7s0@}1r|$h&FsidHJ7o1-l&DQm6W_mjU^r@k(Y z$)YD(j{?A|`ZVNn2U+JsTwR@vO|&)BGJa|G*^^*Z7EC)FyL(9 z%Oy#PDc#b%#1h@87kGOoR>Wx4_mzo|o*0ZJGe(wymmdu1d7t&Ic<$)nBFoflUG4}M5TTLaKbi?k2>B?|CVdc-iBq2uUv@AB; zp(98x(B1LJ1+hS}J=7J>!(S7urn(J`f(|>@0t_JW$(>PTu2@(YZ{Kvh&N0l#?(swK zy0R7iN~`>0ZI*wmQwWXS9wWN%(rt8s7890D$KJStJSNTC>aPnyTi8rzFUTsa^yn;i zyk8mHlwYH6JA^#W-#q#Tz*6TVO;k+GNJK|9nsTcG3f7>0uVVkctNXxj6vC@(;5D5U zDa+!xGRwnFu2U%bSfR7u*8;0frLJvU>re9nPNtB*6q~)lC*IVra#)qm6lORk`q{V3 zQhRBI!O-Ci#)tI7nGiTeyf=TpfWh3%yyfMF(sB30_9f=s_SSS)c07!l_hJ_{Z|$h$ zi7E6t`${Z4+Afb;%H4wlvtyPrIUl=%x>L5-Ztf3W0Ukd}vrL46`?kS>7|fY+F?XCR zQ+Ez7)|37iY7w{H5AGKR6@oGSo6nw%{OyQ|L1`7M_4Tv7z?xI0{T-sFJdRfDZKwCm zt67P015O8DQT(f^IX?$x$uWT3dzD}NU!4`df?00^GIH_^Ihg z-a-m|<{MTA6Vo4~3lmoOSV27WbojJeE&P2!x0uoCJNIr+A9-vn=BIkO>d7;6b1<0a zLm>zG*;0EIEvK&UHgg%FK0TlxonJgXQ%7gJ*T0hYsZWzTzR%an$l#twHl&fK_fGj= z9ZN@l6tkbr`d)Yd_YV|?`g>~0%f1WnIBbL%{we*|emdfPex(f1$q}}`95=byE1H_= zR2&2?pyz!7R5}u;vGrw|+#;WS_Z7yI+B?>k7vwDmOK-Mo1;q`2>Ae}QbbKx45dQNh ze!F-LGqB;S`#UT~#}jtbz8u$a72W7c#QaB{JH8CMqwtz$sebK<65aA=ICbxZA2rOw z?7PRr&G!^3XK%Z}L%u2$Nm2*qZ)~6q^x^`h{OLl=bPc#po~G5Zad8nlUft1n*RBe} z6c1|Ap!*#;6fee)Ds#}7MFF3?9q~xtz?;v6M?(seNHC;9#K%Fcb<}_8$TTfmP(Y)5 z`)AVl6YAEOo4f5HA^}OWfUXf>l=FS+lUuR{<30Nh{m(MCtEC2OzNP$uMw`dTiYg~o z1}T&4i7X9NCh5V7l+Qn2Y)S?qiHmMn`vxKJGwIOdkM?OOD&dQpy_D|+P8-f+UZ)pH zJX9~W?$4eA+vV5pli>-v#z!HZrILQt?FjMs@fqUPboXiF6GE-cq6=zy=kXkfV8cnM z$x==|%OZ{8*Q1I=;ZG=~pu9ZD%~A#ApyCws1nbe4DHSE*Oqb1@gDuW=o$}@NKaCB7 zuU~S?Cu8*nSM#Gr2^TUfTDNZ43Qw%sm@OsQ^Qu90N-Kq)x6#Iw3Du2VGttv|!0 z+bo47&-y2{s19y`=vksc&pURPx&fvE#k;YFbomoYdMvJ`@iw%pCu-b!ty)EG%u`o~ zmxf|$FqKd*C&8r2QhGI}UFUzjVvcsR7;u)ScAi99)}QZe-Jx@=nz|Bcgx*c3o#|nc zVlG9aLZ%#%llwdSPpKUl_Twz+Z|kqg*yc$;pM_lJu=zTt!nSv|CH`PQQfe-@-oy80=@-kj4k=)om9x#At5|5e zzVk1~$chv6P0BN|^!D>+S`K!T#p`QNpqT9o->-;Rnh|m)uM^lb?jiJSIq;@^WpBDn z{_*f61Hge(YVyN|Gwa>zG+tNLKp~NTSPpt;md^=%Sq6--S#_Sh@6d^KAv=i1JC$i8 z23rZ1brS1k%Vepg>KkMEij&NSLWh*vz zY3p{J{<$uSwcc}#&YU%QLyW^Y>J+OQciVGbzov;BN;}-lbsqpNWoI;v^V`2q8p-Lh z$mmucCDvzOp;;SH#wXk;<}^r)dN?DRXr~En=R0#{+yXaNL~i~0%xd|b+{eeqMxpq_ zJ61L}Gje!W2;LTMmLs)pyt(4T*%4Wr8}_O+T}-~;SuR12``kg}3uSA#{UC|p%-7C; zTAYIv%P;cvPxpLIC!V*aRNXB!&dB)gD@*!DKa{Ic*_QXu0cI!G)O9=%69chCtF^W5 z6z&j@-!$eNES?Q3GsoP(xVK-p7OPS_I#=qK20OmL{+BL6JAWbN?c#D*-_j0)(PERl z#P(IJic7nK>P}G-24iKJIK3yPFw+fCi8R#Jx|;$FAU#P(IO8rVmO-m`J!AfZu7N1U z&+f?G2=VyTGsBmi5jIL*QLSXTx-t9%ObZCjq<916zBF1rCSX}(bl9D#+=*RaYCl# zox9VcdL6u-q?lE^0X=nq8q0&)veoP|DA(m`a_As&WYJlG<0Exif2 zx2k%2+&JsFsLyf(-%DSdY@F~pY&XsWLR7=6GZnmMcU%`D>@rwywkd4TXTEFxq1jw_ zF-s=sqn92;0?Dx?x}l)$Z3(D#$X!hcqvmLbtCCl6V!OGo!ibP_Gblc#(tG=9Zy4nL zOh)}30rTEYY#N>|$h6#J=4g&1h5dHOuIX!DC(=RU@;Vxd9=?duv;66=owc@la-A7? zeGQeE3^<}~tTJ0NJ75WDddR11rY(o{pr>}7$sKo97}igKX{N7tiIge?81~+nA5>Eu z9{bJh9E@XYsMC(Yc(u2pz9U)K<87s0`{S?ssZ)SYeXf%!a059`nmUoE zmX1c=0@tLhjiu)!C`|y_y$xR?G#3OLH2PoRXlXjN3($pf{Xo@>KjDKIHWhqJfhRey z*;L~sgACSZQxmBQB<3y(&RwLm9J{W4ttS$kS*$7TJOGBMnd2aVR=dWIMhyCHXN&EOiW@!^aqwj$9yh0m)X**85fNFa)Ug2P^n=slMcj6k zc{*SJJIZU5PYvcHShDasQ4fsc!XkiNeWY^z_>tW8W98Pdz>NR@cmbucLFYa{jW(sA z-1{1zo>CR1e*MJ0c2hAw{Uo2~jS9ib*B}RrzN{&Qog_lY@SpvEXOx!?LsJ3jmPZcn zZ|v@(I`$xJcaji}VPq1=M!kja+^|*Y0EfLN(6A!xD8T*tuND*g+_9OXKlXMb(C*Fz zHASSLX-n%_rXE+WDQ~UCx*-o8Llv?2y^L7N$NB3o00YNmy++Ni>)VkvQv$>i=ZcRdLVf ze^Nf|pcm(7KiS?mg%q>9*Sj*dlSE-zqYFT-<$Om=QTk1gTGHKS`}&xn|a0ZYn`N zNOk}PIf8L&JYM8Jpt38A=N@bt>E|wuX}e(n90>w-Su2;#83{}3A~%Zlq+ECYy#icA z37BJo5cm^$l*onZBzCjbGt_PFqWeyU-l0mfB?QeI9VC1}N*iHRf#6>2rmM6PV4Jw-Xfl3| zR3b}zMg4U@MHxW$t*t>;ibp?%MB-SAJ)2wm?)GWeg66-HR5FRCws6FO=-n9~e>Yya&MaXZcbn$|?{N>d2n)%DS2;AoH@0^iX~QvQTkEtsxhI2s3$eWjXy5TM;r#|Jj{=^r^dpMwkiybrCqylCtOi-wUrNLB&Lp^ z2HMze39 zHJj^_I)+!LITc&v)-qn1##lHo=_Q6U==9fQ``Z&^?gLSKTcI}C0kT6?(o5kf_BZ$$ zb`z`AY<$2!1-y?6&pkRaCUZHyKTO{*mfEwP9PAid={pmpsW1H%_SmaRxYzOH z=&T8p@kZ{jfsfXn`8%VGax(Kmq#vX$al;o6HX{UK_>vJ+GIy-a?vi^X45kYhdAFTd zu>SbL>xwVmzK%JhQ7Uu)=zc_pLaIK4<#isUHAabwPA1}z7;(49qSqDnLlc>vK;J_D zeY{|3HpFc&VMtTE)|*~(!FI#arDd39Ji2g5_zQYFTS@EQJvMY6B3)!W9ZWF@J7PO1 zEXBg%jc1MUThdsR_>0Wv$QKi@Q#^69EdjXt1FaO(7PI#SS8Fao5K-o}?$*qSrA?Jo#WK5bLMIZ0s0LOT?D{Bt)xn`mk{i2K`Vxp^5w|xHEv3(5V_pvMVyC`3 zM;(*Ucq;pLwpik3Igk9zS9PB*pSVR?+zhYo_41MtJY}Gpx*Z)HTD%eynAQ`LA01 zx?B(elI^)2LOUNjPhdQgA!9#Y8x01j)^9FK4 z&-(&+EC;MXsNrVQ+sKZiY-1-q%jvXw96O>vzC4wxPpVe%7 z9IBKI`Y7%=myy~G-Va!kohlJwnET;5V_{!2-@MLDGlDYMx&o+OI=bgeB!Sn{!5d^% zP|?7tQl>E0aGl28peD21z#-D@He;t-UOqFmpIkQR#h;-6?ij94yyn$6>$q#2?J=ne zWE@nB-Lc1|q@;LHNT25w#0lb^Dec_Zp?cV?aSh z7Qd~gKYVlBA4I>~?bnm2E}|Z_`({q-+HpEzB=!rJR${`f?uT;1DNaSG&=Ugjw)Zgx zL&ihPkGm#2Zw%424f3u2%>yMt(~XDhQ%qAH_^_|bGG}SV;Kkasdmk#b)N9$Eh{a-W zP|2Xo7W3{-znetwQ2*Ns`)fXii`aJ?9>&bdenm0cZ$PQF+?f;_AD(uZ|4B!c%L+TS zHdyM?2S;=rX7J2lC$6Cf{u`AFjCl9T=ykX=6Xsv+?e0n&`qUk)`9%<7$b(c5CD*r3 zX`PC0rkZ0f1C8r)m4uVGd}DJqUNwnz*+>y+oI#C_qgNY#PI3!|GE9A|Sbm_HL2>JM z-EvEhvb%Rc@UzrS`BG|bYuWxgQU=JB5FtJS(A=7?JZ%_~OuL;AlohV6j=N@_l3mjQVT54vb<@B1ghsnoe$eB=iV)b08~w(QbwpO0`d& zlWovKt@0wI4EX_j`&ZT{y{J@5nt6zn2Cd;x1%ieAF&j>f9a#s>vTOPD! z&vsEZeeYhffCJ&c`^JNm$3RFC zR3zp#p_Xzh@6U|D?e9yDN<~j3ZJT^P20dLWDf*vzk3oZK=Xndig&sfryF}EreEWaI zsqUH6KfL9=GM_WOK20FMG!+Qs{U8l(C~#b;6OZ4?aYV1&uaH>q4rtiT@J40CC0dyJTS>v8 z(@PJ00z2HTjBV3g78oC-`k_5xmph@_hGW9MckCFlS33QXOuW{sd&;pseTYlbMb)sS zQfUia5mU#zDgA5nvouL4GbhjY>L#kr&6&`*nMp2+lbM-Su7_&*sIQ}_ztE1Qd)P)< z-#EORqPr`9;Eu8>7CIqDq!OPg=HhMyp~Wb^Ss-=`kuMVE04rJ9HT?==?Y)ewB7ND` zJFt368Z0HkAtw!CkhiR@>ZZE2_w>7;y9aw)rV+atQ2K6r>`R=zwRr&>yB1I$uKkYz zEAHXll$zxIcYJu6xPnyi$rDcZ6*Z)w1`qva$m6=%I}*vqA}I-`06V>bH#AW@w2kq| zZV!vlD6uvvh@o7ix-jHZ&$fqGRoK1{!Bt`1wR-!DyQIzC-#In?E>cm2EK-Hz(3afn zHQz?GN}>A$^?DXEN`0ZH#yM$8*?G|tP_y>nR3D8Wk8KV;39Cpi`f^IY#kf`d5aw-W zi5Yyk)%jZ zlUTo`{ltM@|IhI?7Lxt0v`>#vvQgQzbi!rFjm(BCgwx_n$3Tt2p-mCBL?ionOpF^5 zm2v5y-q9503cE10YtyTOPAe(4) zIhyC|S6#I}nnBuKxaKukY_3pa?O1|EM9VC^f!$#&9m5YyOe`=f%y)y~My#pcpYk@d z%x)&?OU!uRGyC~k2%mM;3|(vMafJS9XTOH}WKg~2ROcq`9hB6+mr|QQW%Gout*)V1 z3v?D|4r9#M0=|aFXt{RGTe$2zam|?+!Fb5bj^(~{vUVifB37Di?QkzbpKeZ36Qsp{ zk+XX*vrh-C~BTV3it&at7~ubRBQm``6Z_UOiUFQPhkQFQ=cWXfQjt z$Y2)pNNql4`1k_MdO+2FYMMr=%7YBn*Q|FzLl*B22vJ;7C!>BAyyv!NeZC(ZuU^po z{Vx`AX;H(^ye)fIVbSHnqAWP3XYO-59is=+;*sJ> zFC%*Dz32B0qGjuN(v21}A0PYm6wgq$p#{v+_k01Ybd+|(dd)(9V@F)^%gKVGA0_$y zpH3tR6Vx*Wnbba(okw|nlW~Im%PJ-B+8pzMsg)9o)z|ZA#kuvt>^Iu1P}BeHh~G3H z`d0{>u$R}IKLwR7aa4g)v&f;88={%AR!33e-93q;&fPw#sg2wjydWKQ&C(yDI}wr% zkgpVn-nF97r-TjF%PL1S?!sr}yu)vZF58!j9dy#)zun0NQ(F4Vy`4Xj3li^eBhX9z z3yCZ3c=7nbqV6^x8)c5f0L|kH;vh)xFY!)tqRTk)ll=H!RoS-#A#UwErV=)4Ft*FFmd>j)*4GD#tKUPevXxI2>C z2sAupWi|>+o7F7XJAi&)X<(^Ap=L%_4+OG}BF(Z`$V*-#zGP-MzHsx4(A10#XP_vF zKjMjr1IJU85Y@I5IP-`yEblwIfBU!!agi@AZA1%*OP=|grUC>FIH)$C*!|DSDM!5q z5h~-zM3>aXqEU^P)>q2EJRhisd`v(#TKQw1g=GXXqSPmf+9My^G<t6Zg>i6wEnGv-M}{>mmoCca!GZFZ7X^(J`Cfh{|YZ{Oq^lgCOZL z&EywINIZKX+=K`zA;iu^i*NmJx=uGH+}*3Du08BWN@kyEy#zJ)o?8^D1F69xCFkHz z$$;H2^^xsr(T@}T6KxLqTVo^u-Y4xsaEzCLqrBSpk1Is@zJVD%!fmM3`VYG|j!J=z z)LATa(DW$udzZ7973y67A&ESXW?TPquWNSHOD;2wiJZ+ok;R_CeDB^}MxS)1NZ+2W zl?zDvchYQ#a`hOtf&hayXP>rYJ!Z~bRM7sKEirpL=Ctkb+enK??`T=?yAeA<6BAP0 zgMV)j&4XDC6+jBI+LwLT!MAJ_d;3jK$(NNktRLV@(Plk(^cn?hMka+GdkPV+Iv^c zK0%C?g6>fUnipH&-q%lA(-@Hrj(>u!g+8c|PfnV4uUU+@G>Fqn=8h>H+TAnDddEwC zRCnYx{byo>w#k#J%?p7@U9POIYo+^-xyi^{dXX4KEK z2UlpR3m!&GFv~vzB)B+;llGuR7D1|>n7K&fKu+~S^3Be+iwF6L!hY#CrV~l-j3i+{ z@rRcHt?>gX+7!v)jF%n;M#g9J@1mJwhgt;8SQEDOY}wMBCjGzIS(lh3!&kXHVTmrM z(h32(*RH*bqV#1B!soknj2w_{!D-NMkdMzZ3yU7K;Z)ooVUEzd$$m?=^uGlZn$7M$ z`TvuEf=mj8_E{ER!ZCs1v*e-GBMDj-`FoVGxw&_5$To-x@S}wO*7++uz2nmqr_H)` zEfRL<(M8+d!OAxq^|Z0`1symN-r=t17NIy zGc-01yxQayycE9^ch&qoXL-jje99t(_hP>6*6%F6E{Y>!%b6a_u4_F&buTKS`(@?W zqs4?)TkK zRL{teRw^Hg>s|2=JX?;HT{`ybwMo5jV@qNs{C3o{tT}@C7oWu)q#P$jnvr(T&CoRV z@?2{5V)#6g4X9*8xD58S*flnHTN{uVlEoeA1YI!{>SWy!Zj7z2PE2svdE9(%tc-Zk zY43wriDe?2*J?of)_4ve5OzFVJ3q=9?|V0jTW{k1(0hsMTz1bR_T|qdBtyDML%z%n z+m@63ln$7)0AtSo-aq&9GMDJWyJv10(0G^up1U{?3aTvWw-K(1>lJ9_vDfpXjvXqH zo=&@bw?lIt_(hlQ9)IiH`w=YQ8q?~AvtwL16;D-3gPqyk9%o$}m0K#`0a0Xdvn0N( z{o~6XmY+RILcBWM@f}L^^Cba3r+j*=5e`E4KR+qxUG@LpBi}LPT_pKNXzpV|rKI~?2Wrlrt-MvOKJH(wPCRYDGRovq3T}P&Uv{t5S zrI})YqxA)%_D5z7UaObK-m9zZceAbtxYOPVAtH{X&{1!{Q4Fn84P(n+wk@>TynDH# z+B-Jv&vx{)J2^^R$I>zwy~%i&VQb&?T3gp)z3Z%@y4jZ z)>P<8#-!R;*4D&?$4Kv}Il920n9K+9YW#6x*{dGcR|5aiy}U)0)A0VV3lUL-R|-Q+rwvka77szYfiPPm|uX{op#t$>!G@6&tVi zR{#qC?@G4F01I~f@oTcX4dMSJBpesfWJ-Fk>|t{M;$huM%ZmR?!qbOenXZ8N_mbZ? z`SxPZWq)R5z~5=EkXW^U@M(l2k#};BxOYZ1v5Jon>3E6+sl5;I=T4Ibdb}YE_lyx< zn@985z3RIvJH`|(PSYmD4@X@zKKlsX;!{S>VNoFuy2e2gh7XG8^SFD#eD6-k#5p^j zjPz54D(3w75nD!ekuILT-LSbKDSH#~qV|L$%Ro2l#w$2ok;!Tg6C|m2zQ2-%%-~?* zf0&YD@&NgEM1KLeD`4L&CC3-^?sjLFHJg#0lBL;3ujPq@(e|pl>YKk-UoQHB1*n+P z`7yRF0fA1WvipO?B!e;46FXP!1*FP3W{AZzTbudga>LLdbQ*h7_nWc46BCVbZdJRW zd$W4juyvWzQ%m#crW3Q+d4Q4tq`I{S2&tEBJP9=vqhNv6kXYXILt%U4-TP*lH%b#v zfve7Je9#@8eTbOrf@@YY{On@x4oz6@CdWVp9lxoG$sP|L*E*=Sr_Gz-b`B4*_&39W zXH$(0v}a}0UtN($eKC?ZNjDTK+3%wG|Dgjvbr)W9MY|Xoe-1ZL>z&Ha?|-EeLGhzk z@LkD+VPmMuGYz^zH-&tb=gDj6&uLV4UfkYE`3Wv>1rr0XrJt-((a=#U&V77~S z`sXZC#(OXphoY%d{~$p#7{hYW6P>kfLXBm77gV(ts-WPUJ9B0qNIz)Lt?Tb7*N~32 zVD|P&x5-QFJ5^Hpv>(!UTzxIOb8^67#>~uLzvDt|p$JP%H?Q2uj1TcUYNUshfbf@1 z&gXCqMF%ZcxYWNj9C7k6O&qIz;s7V_8?Tq%$7LK4!0KOG5_j zpZJbiFl2I1tgow?pH`!^*w6){Gt#o}MJzBa;hauJajEe81nyHFGP-$undJZ^_9C+{ zC!nzVhl6+Ex2oq>lpxn21?n)g#?WZMRMyJ&>am&)qo9jHF76AS_M4lPKWt(?q0hsf zJV*WlPyStXJEn{fPCR`mar>eC?QpF&Z;P=aKr-OT@_MK$U-Cr%as^%->73CoSF?M` z6n~7NS7Fn~Z1ISlR#$i*y+PV;DK4y{ca!xnx&g*^mC`Qy!yGt_?Jt^B@?FoLaUk6Y zAi3=itFpXBgP9}kFvo@M=g&t^4|Bm-UsvPN(XgyKT#|`jFX0Q!`_8$EpyM=nvSVxR zHg=H9rMHu)ZTCI(SF*M?m;+t%U8%bOq-KnWC zv{(XcQ0`Uq0h>WBW;u)&k20YL-TS$6Am^Ra?tTYB(n5IP&KbdBAcI@iGHcv;={$C~ zF2Y6m<=w@Fg0J2M+VJ|h;|t?8a!$Z@8XU3fWKuEfwnd3Wu#v+X&(}7+ST%J}*@0OJ zBElwtUadKu8b%`oD&hW8GVX@-#hU}#B~oK6tS7U4lQ@H4RYz5^J_h5|7I+nc%?{(m zhWS&3GH4U*$Xa07Q*AXp|C$c54gTq8&`MWakti&=2UfssT5aPF-T6W6KOJLe8eWVL zwti=^Sg{kd-t6&J!_a^GEBIBFRYHW6oKqDm7!{Mx`sWh7&mj2k4m?b4VUsvYmkL-b z7P*pRpg{7rFgji%Q-aay-ZjJ+?ET1J~fp5s3X)Xqt%keE2n()rz zQ4OLrqR6;G%+C@Id1(Ax*eIir z_$U%7E1Y7{p~IV+f>Tqd&#kIK0RVc;1W{&LK_IT{@Iqh!?kmxfa_JY!05e-#_Gm4L z+Q5%-5jT%+ z&aPlzA|kRgHJyjH&o3E_pcte7FBU-42X@ug!QFn$SCn2|3s~D?kvg@(1JH;QrnnMccShs9<0~&5Ds;i0H z4lV>?{QvS!-Gc*TwGWsmn<+hu6suo4Aoqct^ z?i$fV8t4PiWmzX@?+y9dmLj#k$DSFd z97}X_vg*&)#L*Rj*R@Fd#aIK!aG3o%fFv<%x~c_^j9@`=K2IHEHoYaR(liju33`j^6hZrDNDL7m?J|D4znpbcvW2T-EZT zO7ZAE?&mIyyvMtj^P{uV#tCD(g_-$lvXCo!^jZZYdwjV(-b)Ff4a}&HJQ`(hPTjwu zpMHSvOiC>_JNWA9pE%yX->S$8lSQ)++nV!R7lvI$0yGD;}i}FnSk-8O~jHjkt`3NY3<_LN=yHH7uJOL;`)PkEMYW6Ig37>vRLz*4MvRTHA3jz5_Wl6>b|!d|t&|_w9>9n63q`SD z9zi`P;tT0sYuQ=ad5o3@WM1rXhZNYDWJ0>b6- zqu>Q%#$AUhS|m=i_(NLjT5l|5c$8Z)?Gd@~vMEUYQHpK1V^_>E zQs5Nwqqf3ru7jI?O+MzX&p(=~lz0k$5TOyalX z)3R)D5P9_UD$-@|`!~*MjKuGVlH_jtDvAg%t$0<2P4XHB6Fv+gd;;KWZEZqX<|>8F zp&?7W?(3Jm;bD@kJ069+aww6~RcKl0IP~kql8+}giukETf-Do+NgsC{tz7t0CrVMY zr>wUfqRhComJmu#$$5{8YeCZckA11MXP5S6(=7wakjVO)O1q&nVwYgzbHzbz*4Gh? zM{v0osgJxMk>@OD1$1fWiDtHb{h*AjF^ihZaHi)6{3{J(vTIQ_-Vv3cfSucB`%LLc zo<6g)c6NFsTv5nZJKLN$hsSznig{NWvQy7aFb|r6qc!w5FX!$x z1?9V}%uF%I&9qJ}ZSC;W2^`N*GFs|I9{16;AGAP{-l*19k}_KV<7!f*I`?8>dcknQ~FPhZ@O8Ye}lG6&g&Ea&x%X?aB*-cg4Ue_V721^?}=UL4ov zSB}3}0x+-)Fw_`_98ZA@!wMg28g@I{nR zSOUkj^4I6NWe*#H6C3f0OGr|!Y4qjP*@59Uq~284>9Sbq5MQO8d_2F$w1&F`>ePOQ z3)IRaQ{htJt4ChaS-8Y;vyyQr3VdG?7ai~lyh$s(4Nx&26-#Y0g2t@Lqx`{9D?Gau%x=nO`mD~nnf-L;Iw_&a(K>&xv?bqX?+PK=ti zrFhGYYgixdY@6CUUcTd*4lOD4=*CrA^=$VI0PL_G7Pc{8T-up`qs#de$q4N`GTdRd zdv^n~nXj|DkISV?Oq>B%Q9Ky#vodsVN+`Fi&MV%9nYKs3*}Pv$8zUYvhw%qscB7X5 z-u7+nx>nNV9-WLfWf#Wcdta4$S;C6yQ9^;Lz+gtU0CLRCEyQR3dk^fH0`ZKTx(@z2 zpLtcWI4$bR3{y(neXdf>Var$^9x4=D6byafolkJ6D|M8ZYoI+DE8k-nXdEETc|8*t zVBK2{KFsN#LqZ3T?pKHruF0982-`Z5NE!0Y`KJQ3Y-8tSn=RjkZo)|)pB;q+a`0BR z9o&};9R8PzH+ZmnR+;Q~CNh0m&hH_O2m1E#zGBWcHVhPqJS6@Lv34BND05Y!2b8Y! zW-LxtRP`sJSSMyX142Vo)<~5+j4oa(Pj8%N>^F~AFVurG3+4JJ+&;L5@Of@lO4VTh zLKlioW9fTlDUnz4(S|NAacdkZo!c$bndkkuMs`6m*(P}(kLA1NcCow?jWu>E!|s25 z=C_A!30e zEul=GQI^;VJ3&ogE(Ohqd|-2Wvz*`(AD;^Eix0`GQGeQcB>Bj<<~v|465MbvrsZmB9I*Ii??j>2B^$ zU$;MN@;U6V2l+qyPU~tGL@(S47`8VbW%d`?0t{nhtz({ zi_=G0$8|qzc5&DeStI|Rb$i*6&@4a_puqchb+f7Hvm@igvz zB9c*`mCZPqS$k-p51ZcI8Rv9Lr1!CGO-4&zsV`l4)sXJ4F+)9_UDMsI(2ov!65f;?O8%%Z?(8%c( z$Y9VAL_6JWCw`1(hJ=Q#?9}ioyxnO)FDr4|HTj!jFH#r%1vQ1%jScwHnX7?@wixBkSSiotIudz0{p zAif}RO(2bg^3`S}a(EXXLUsDE)QGD-6u-<^qe(EHeCQU6Ldbx;hp-cs=2?_;rrgz zo(oz8e;R(dEk*=d`S4#X03R$}ul@&H8-&2ztbijYm073D&$nBI%OMBZ5*}u&>_L$A z4~8ml;{Z71e%VKgBFxRat5*T*!|9pb(U5bf@jSxMbE@c})8_+yW2uW3i>bWJ$#J-? z3Rg79arDG&VzyfFx{ug!bVZ_;7vR0ctYG}%o%k{3+~qEf4Y38g3$!xhs=pjuAbXYD z8G*kx+DzRfSespA@vFt< z4t(+tl^j3RQT1H#15?T&}#3ra4ON~Ll2_>A@l=B5uI9Hw#+CvRNwlN5Yg{=nX3(6@ za5On1bsw7z$!DwQx1?&f@-OY;%#D7CR8_l@YJM5_qt2AeC7#ZGRq%|KIVz#FWFV{;iHv=WXyP057*SXBINee$?ZiX(q-!5zoGs4EaY6bN> zqs{81PfZPzL*5W2=GqE@v1`U+G$$pQH=vrof7YYLM7e^z_T^1kg6=$*p!KzEjrSSP9I3eGBsH}{*!$9sWz%4=CfMo`UU@Uu&pW%5 zG>2pcl|0=8a|>QRmGqRPoa3~XyLy~>+PeXB&Q zEFTD?#%22qS@XzMG3(T(+)R!}9v*VPD%z$?vbPtfIky_5K3Z56D-O30avHHEI{58s zd9&Xi-9h9zJ_-I$%n29Nv10WOR=s5Mk(+JxYnE!x5V?6^_q84iqMPqok10H%0Awo4at4j+ZL8Y&Z@4u zRP3F|2a=gy8`QAZ5R6UAV}T$J(XLS>k+- zaVg}?pDKq_uof8U`(G#Pq_RJ&$nG^;mM3EyCtRY;8??FCE6=baoz+1j z2|YX7%kGanS1H*e=&Z_{<|2taE)nE>!Zs06G}g>B8ysTqy*xgCauTb|ZFMG2n$%N@ z8t&T2lhZdVj1UdDlq6R7v-Dm6Xq_KbT|cr(^nAYl+2!oF_kM-_T}gS7Nj7zIe$@Es3lH1TvKvS0snpkV>(w$P?iiT1@vGWM?uBD^&CVbhgaA z1W$3`dM+>sr^Tk-a)b<+Am^Cf?G|m(_bDEyq}ogUv*ckdcGZ>sM9LymKMi*=xYqG# zpX+t*Qt@{wLPq7-v8Gr{3_>(4!=XLLU;NTgChJ0W#CWAgQjkt1$2X? z!>*Gv(dCWik8uobW;n%Bz)#h3=fC^*k9S|hB(Mk#^Rp*79=|l8P7ya>{?^bS5vb!< zKl|>-6Q-0_Zw~*q6nTyh4GokzBr1emqo8Fjk$3@?2Xad%&aE_w)ekN5dHnJ-m8nRG zJ)dao-E0P4eg&+}Rx7-MZ6(WIp;x2eyJO?vxv3_5|LLVOun(nh34Nd>Kuh7%`~}8N z@D(Ddk5B!^1^`giz{ti8vGIcQ=IkhI*>6<&mn?~8p4;YVyY6y&mM8!M6U05{K9#-d&VU~5=*TzfLt5)tgB&@Qo7PM&iS&Kx$fbVzD)RH`WW z3a<;ZdSL4`C1-kH4E?0SMZ2k|!cC&7M>j-ywxl(H?4ZG){H07-)MV9E{{^M7g7xxU zF!cg>ZKP`am#jk&qZnNDmuKUo9a6j;Ye7+982fHraI6+%+C3s z=IVZRl7QuL2Lkxp*)C7PgC*MJQ^C}*Qf#MDi>G~aG!@#CgS1Kn^flXQg@^03Dzc{t zo;4ok`lV}fnooF!($O?7vxs=#rEa*P-7rPaT03=pqp-T>K;*%rr#Cqgy~!-{sgv=? zC%x*9zv?Sz`Q7YA!1lI6yD~<(i%-i`n37TC30ygxT2Q8{uMxr=1b8s(@+_W` zp^#8ki#b7WV13jY>?zFYlVKkB+K}EvbQrz7+TB%g-$UYchB~#!i8!y?H>sBh04C;b zI9D9Isvj0sFIfN6H-la{z4esCzbl>N2-N5@s1bBIbzWN;bm&clY-EB6EK>^V)!83s z;Sd8z5$Vx6W-YVZVKBjd)8SG(ZkdtL!gTKDdas`{Ra*)Lz#Vl}9ON6upOi~CsFoWz zfKY>kr{!i=wn>d`kxn>NEgg1)2<{(~0a={etX_W3C?r0MaT_l|fK6D!9*KGUL`b|M#3e*SEdu^@du8|1om^{K6eH^WB(r1}asq>sb=bdl zrN3x_*Gw&Kuu|+}`cBgK6JF(QQ5=Zl)lR%vh;1-dn0`p55i2XC&0BS)+|X#&Gd%(^ zf*Je((zfSDyJhlvnpIEOZ#lqN*@sXX1;m~{;Q7a*<*4_ps=Na{yu?7b$w;f{H)4+7 zAB{y^{LG%;dH-HuWwQ7tlLzbKA4p7$?{x(VFGzOka2VFxh zlh{$a?go_!^W1>H(>hppG#)mC1Vb5{Boyx9%DwB?dkXKd4m+LA7or9D_)JySKj@0( zLJg=s_c8z7sC@pJoKsKTaIe@dl8DFt`Rdt@gy5ZGv)~A_R4f}?9DldTUb58tkfB?y zC%y3RO;rDAtjG>F2S5Y1bpd#F(8aK!{}>GXzjH@d^$HW}z64udY~wBegnD22w@zx` zuAXYCI9uOXoC%cITn{{Q#V)mE1{?*&QuEbreRiJ*0)5w;zABceaWZ^%=!opC^MmT9 zx*^s>9F>k;wIdhfDi*p}l1e$WB3d~Be?=(BW#>EI>)AjlJ;`R8-@DtQSSVf@VE2+_82%dx4(!B7|Tjh3#k);JaW(GavZ zHWk9O9^px+JLA7!`>!@WVhQXsF45bu@LlLQ(oVIMy?;owFk<5iJxSI7jOnf=X%m@`uG=@D6kh=U{H3{Fk zA-J@0l3K+tTE(ZiF?U=OxEimh^3{pgLLmyiw{VM5p)o5}OiTnHyJ%>5#Vtv4{>%~1 zlyXgC;dx)3(-GixTvK(js|z{a67lqYd54{V@*p;AagiVMT#6q5eJ595JvbaEVNtf? z3BYG+i|rlcNq@nY97;=kDiUVq0+mD`L_D)nA6a@pC2KX;EYaa2b=rFQ&IjZZENV2! zjHiMwW0Ht1i5kj;>!`<#45gJ{KB&Mnx=I_vSI6n3kW``7~64P(?<37L`5cs znZx1hBw{}umq~ZW&2_oUWpt-@3Z43a=~-mmrwE$HaOH7Ganm#k6w0n+DlW#Mq3y3p z{Af_rtiw^`SfoO+3S=VVE)wXql3ri_BGSj{6})-CL?2PuZGNnmfgRoid+ye>Mq8PyeThP3$O7$c`+L#Q zZ06Y~0B7_ot69X&ta)_Q`gT!Ck(A@v!%a{}KB`AuEhh1KZ2lnxRiO>$A1$EV^5}z& z=HYpIViuo4b*(_pq<_a;Ri+vd=`lb$6$8YHd^L&J(!EKz<7*jan*wmX98MHl5PR9_ znwiw*P&Q`QIam zFbLc81pX4&&8%;*>HukV8CAI0fBkfLUnlPjs}gXf!bgp)TaFAL#jMXlQ z!mUlM1OD*W*<-MNIXK{7a1}soS4Kd@#eF*bxR;M(J-a-)aB+A|a6bwlmhju$9t>$} z&yFdTVbr#O4&|^QcL(+?05ZkuP4=mKOJ*ODzpVBFX*kmiBj4luBt2>8uDk$WUa;03 z_lT|u@usI|2EXnBuqa96hL=doPVr~Dg_HtF!e%C);sfuV~kYmYKdXxS{1wY z)e4&MR4Bf|M?`ENu4_@@8V54nk?px_x?5Hq5m zUDem-8nj5=#XtxB-NWQ%s=@$iqS8lvV=3^sn2BGW8wK?ON=lcGb3_3oK9{z4(hdc$ zeEYaEzI79O38%}b={tUbT55x8mNhf3mx9xu71>j0HJjL%$Oe6^lJ)5ti*j_g2mmxc zSSVrH3WE|RuxhA#z!KCtJ=H&&@7giA3uie$C!cTn@F`v|(Xb8@I`H0wR#YZ~Z#ap2 zVElzrBiB~Cio8-hlk8z@{#9Y$y6sTuY3l1QoC<$ChP(3zp9zT!j$M|l7i=0d6ltvG z`BBphEOKi6;!R0|6BfP>=Jec~O&3noOf;&4SjE@2uF$&J05Jc9w6_Y2D+sp*2?->4 zaEIUy!5u-Mw*lhsI$#XTCG{o|lzvg?oL z_SLpwO%-wG8W=uX8L2m%00z2LjBN`S4_b`1^P? zlJlz5c4i{6P?$E?QQvzC>$G_kAGO9P1|_5rZ?#YL2o9aq9W~3RP7T=t>ti#$r^t&6i{%7&e>A9dnbmkNB57H_bXey+>-<0|GlhqSxFJgc)*8Qu7BR0h#v8o5 z`~Vx-vujtU)_Ij)j{?U-E4va{j+Gkqd+uycNureUcN(UbDjG z2GQK#c0{9N-6AE0z`lRR&7vbe$pZ?Xc&@&EZ81mFE5t^6L{%R`TReE|rLcN5*!+qt zh?pu*qERRX!hkbNUf=g7z35|eH(a*Da!CB0VktV9Qmdi#|=_|%{}dG zo3v(d*TniGFQTtlI-0!v)G3oBL1OtVArt(JCeb(ak!?)B-gz623ux!EF&paJ_%s~L z=}6J;Jn{*|4q{$SDiyiK{=g&B-};R#dMzeePw&}3N|-#k*1wll^LQ3L#mAR{06mZ_xNd*YESK zoYxv^ z4^L>6c!>A-zHf%)JKIXgdc1la-1XnclS&lTRz;t<2dc00nRi*wo|=LSj@oEqRFhW} z**t_WrHrMn1a?hA)^SUCi{V(PQ|1qox*8+Mx}d z*hIdfszLC^ytt)zXG`V(e|GuHG6 zmpwNswUT)grqMAvw&iG@wmLSWaVh)urYB3;!IL0njE-D{{gTV1xOtji1sY6W=hNm-8lWR+IJ)G-Ct zWaef;!0}_7wc36TGS%R=^9_8ZCJ%k9v9Z;Buhocp_N!f#kFE>iHeI`gosifcEKWuEQSUPnTLQWHxSDjIobN- z@SGh#pH&t*%``QKo)m3-AV0V%4v%V?4DX6xrw+)@vjdOsRjNvdQ-j|pzJQHf9VHr& zL>vvdstJG8!4&7;I{SXlV;C&WWvug;w4%il2|}%b&gu%Tbb-m>?VV{p4W--J)n6k z+6c8O4x2T|XuOS&!CE9EXAf7=wX>sbv(lftfCXKT1!)82qk^r%(j#dIbPji81YT zdp-Nc5vFTAN`F%#iA}0@*j#0<)uYA=ZjuORLUb$LsmNRn%gb{vf<2Ka)GX(TKku?+ zbXwsxDsPzt~-nBxXUB0=x)`rU@GX#6R%!_2AmUcn$rBO!^mxxrD(0Nn_tuTU*8l z`r1tQ{Q&l6%d<>Y{lbsvS$j2rW&d(+MnL*=?xWsL!_V&a>biZZg+}ri;(5p9al4bn zCF7C2Cy-aXKMg=jld+25xnT(i^V8vU$6lny1u^WW?Xm7_w z>IFp$S@?}Oox7|XvC4mVU{e0%Z+YX!iVLAvSSyT&-TTwzewMbN(X< z)&=L@BBy@9Bp81zA0*L@C=`-{vK=Mw9&!>Fh}?+~qn>AU_s8c@{^-M8Mpf} zsZlg|P-Uhm%^0?QpcB`J7|B;7uLg9}(}K@@AJ;LCtm11?0qgH_B-ERP~sCtX|vQBsWFSWu{P|Q1UdqR&Jdh9Qc<#8 zP0X(D!;MJZ!89Q9Xl zxrGIdN*w4Pfu~R8qoLvE=jW!Trsm{)xg7BQ>TYd5IB!|@NW`2U{ByZ&95x~NL1B+|x+ssBI* zO3tmx-}6s!?NF-t2qsjsz8vT0icrkb`Kbik`(IUGg;M2iJ|w?x+rfE>AX|%X+dV)( z+&xeyr~k?%-*AOMwu&X83~<|;7U)WVn#?B3{u0)8O$6>b5497ODaWjbhKLyiF2td?E$XeekZ7D zV|+aUorhKUGsx;{=Cu59ZdeoD$1K^NkyYH<>ecRCo-#iyu|BPVI~;aGD&D0;rbkzk z+_eeF#ODw^fMzw*$MHPL(_2>*Zb+Rxy6QA!pmv$D0Lh{tH9R&_UT+X*jW6tNhWSIO z7gS9`1*K!^E)eGLepg~i1lx>Kq9QA|nDDKHAv7plUARjq5(8#qAW07%pMW^=jxt3c z2+@?SW?+uy^&jpnD2DKBh6P-bJVEfT`-3_HNsOU1 zBG{-@M!^#I362b!s3+?b{!Fg6f(e610}|uz{6TtbA*7M z4^byp$TC`}sd0XX*jgBGWGeq-%=E{$l(;P~cdfp6@m1$^u_unoLditM0yLbU!Um{r zg=5>ITfP6QuxdW`4IWF@e$ex~P9AwoOD7GFB`_8gjME;m0aV@k zN2RCb#YJ1v>A4!mi)JOIVwW?>B=c*gX?kt*#cYpY$K}))*3=GkeYG)F^VTYMk3=s? zu1-m_v?fc{ru<^aix|zQ%5dkJ#pPiPUQ{3Nqwy!}Y#yMQq3w|kt0Smx9oVCS`MUW5 zp|sRO@7k2pS^~G{1C(N~xV|_$JWqI2idDbgoqL^WqW4>0yE3>%NmWE5O@id1E*RFP zJj&hDoBiZJ64+2V3%EeaNUrrbw^r*mEzRz8&qeA zQ?F@KBH{3gjNwx=qX{_><-GA*ku-TU7w{L%-+E`J9*x2EDez_z)qZbexzMq*E4K>2 z(M*xafT!koir}_DAySi$kcjqP#pt~of^A#K1ojZ7k#^Mx_x-5jZ2pE+d>uwrVSeB2 zE{3_{N0ns(Fp|Ns!>2g}a#XbfIc!g@3b{`-#W0xBG_rBm)|ohx=d{37Pk6yyc2{2i z8Xjj~M~_KE^J`fp^PEko?d|(j9WImJ2|CFNm9XzZA(qnwt&$~P!H6w#&N#XjG8qZ% z&vdcc#k+jSIywMUjAB9uYJ6l~t(GuN2F%Y{+6-t*EmngjFbgZ3C-Vh(KsDDU%F(neCe$W=J^~=;9oqJW?5()tt+!+F z=swWf=}N^E&@{jdy2+GrdQmTUZybol4k_U2ct`o z)*$+5_t)8)1d@8R0vB9bh41js_shJ3Ke3wRPbvIPp=g{(b^l&4N9WEJu(VG>t@Twh z{tGKNGO{1aEuTjVe!D8uCiRdgF?@`0Vx-rvx@oorFARJ=B$)UkaB!`i^|Xj(yp{3H zq&JIU{Y_1!s zY#m8Vk4q5^6s$zGt?~+FG8o1GtAYrZ@>z{~!*PhpTK7chSs#cH2us56z42b2u$k#h zOveQy+tTs?;UXlsb}HD&{v&sR;{e8@klrr)jhlZKh)=eA6f0_~7X>X8#a0I^oeV7% z1(i#gw}lUuw-oUbZlX^pB&TrzZ_HI;cl2Z7j4EvE62~+65Ee(xvvoXv$9kR-ow@5jX zC+4?e54U;tm>1MRDMeG`vchk9ufvHHk=Rp^+w!N#7~KbC>=UjAeoBO;>i5O@M5&tP z*x^dord2wBex9zBdX)YktRhh)5V4hX{g$3%)Z(dK5(bmk#c9K9SY0peYA;{*^=Gu) zfivM)Rz_gpJ*w!vLm7|e)J@%DPjLiMDOdZqy^@L}mye!=1X}S((?|xyG#4{jow;MQ|{#Z4y%!*>#x~O1=yNxt6rQW`P_ft|K za+hP=wsk{_NoJDPI{`n{oD(cG$@l!bY9GOk96At2xi00wx8PLc=zs?rOk9VRG)7673_b~(FqGx{hCXY zOii4pb}s7ON$|t$)(t7G)=cGg-FqIqhRFA9Ui|e1NomE=ADfr41!DpS=j>ZJ&w_6f z+$0V6C%t-jqD&)ec$G}|1K*JOA|=x+Hghq^G@mFbj~v+w4SWWV>l*ON%3B|6mwxM$ zLdE79pW=?EMbAL+YTrfjj=r}W-{gNbcXr6CEZsIpE{8f_BJCa2<((CY$UX>+cce3+ ztPZO~KEU+*+c$WtZqiL3?*m7EzCl`Bt^3(GU2c9CU;j|~BbF^>YvQsaWIAX1bneI{ z6>6{1?~~r8n_XQ>N5*2>_bdf>U~O4q*|c@BXs;@ikM@kH8EH-2va)kQs+~%$vcpcm z-0;8(0wFQ$B&n+IJE5$ZraShkpyE49v}I;zg3fz~DE}I5|1bR};q?#DgXm}R&*RXa z|8AiJ^<5*UT1C_D^15zzW+p{^AM`{$(YNc6CG30Fez&$#YfAIb_JjD{-?{YPM+f25 zm;32i-jF_C$31E)s>=rf5;TAl%mpu8K<>9Mi}NM|4m*=TpR04D=YM?yn;wtM7^%y5 zPoNP-%fnt39TpobjGePtM&4UZ%`_(giuVQS+vQ>tj->Mk7|dPz^89KWaj2D8n9FhH zx_alUP^IcWx#?&rO65|H%F0Uko(EQD|D#VZ)IIwp(fu}xX?F{itxEY}P(?yaK)%Ad z&(mY|M9jYiLvGNEr6<^oMMg3TWlKV@LXbTHwJeYE_EDCE`6}J7MI2=~W`rSC$cEeu z_iO0eagx1`P1yg_RWuXs|8RD{h=mG2>%si8MB7A$cKH%6H*agHo7#Ap?Ym}>{<7*k zqw?%0ybrCb$56@He}2_@DofY27W(d%wiQaRPrCdG*t1}K5fiJg z2%5q2F!y29VVm?hnD7OK>ZQy(=Cw3SYJ1$db|$f3c1pp)=o$NoyzNeU&^)K$zDnL= zbl<$;Bfo7!xNGgZ>uG78d9ZxSTqkAV$9*Vd#l?yoyB*;_axU0c83!T5Oi>~p!%EJW zlB&3wf?kvPgXZtm9nLC@T*`_o^M+H~j85~&8|oPw%%-N1 zP?qJnZ+C#kGx&N54Hx}Oyw!uoFc;!@W=z|VeR_FccEUqn`pN7@a%;o3S9gydrKT5I zl;`&_2bkXW!KCrJziW>38($YwlM}PzKocVXwafS8XUxSTO}DNSHtjq#EPcDiQal-b zy)<7^-~GjnW-rlmQ0Jz?=g3?p?c@o-*$jS9H1o!Yi;e0y4E>C|CAlQM~XmL3O&F@4QKD^6rta?RsYi((J@0|LDtKAGTJ$Kx39pJfV z?m=MDYA$S=vAC?ddq~CLun$y_|g;tzVdNky`+M0?V z#W2UT-j#1IhRN%>@p*fhEzkul$&z}ug25i4aunOLai%PCcdFjcm!`p}l3z9s*@%Rl zN{VQ{!N7ntDVc6jGck_PRJvHJitpmY;rmnJp5m9jv6%kxB?rO7{2~MC+vW(o^sCGW zuU&S%y^cy66pyB-mJ4*lvw=kptybR-{bG99FSihFo2?1>v*g$<$5x-)TT#6(_E$S{ z)bVi%lj{q9L4|?a2Y*-j$ud5?sHw7TLUTW#fU$)V+D03EV}1`{$-lMi-mgL&MeG9wsQ#_K|94-?!Gb{c#${~e;D54R z`OXm|oYAcc`Fyayq}kSv%ub-D6r5ZHuzuC+4d^gGD`5R#D)sw?gv%&kQYg18|Lr*4 zOUt&M`Wy|=xel9OTf3as@+EnCE{TTu85h~eN6;#bVA|?>&f|3OYc-m*`@^p=qgr0! zrwXg{wM;|34|C`+a={Y{(Bb}vW8xpviSd(@l_s9dZ-4jgc(j>)l0Lu)761I&`&CXY z*?1yLNBChVW{@WrI>0c8#JMRv!0-e&%KhU)r~A|CaeTZ|p&}F|xz}E?QPa{I;Xi*i zeuAJ4?FT`(G0<9|vZNYE^M7ngF#T|Myzim&6H5Nc^xr%w{P%!~|50ZzwtuJwG{&C3 z*#0##ud?8l+l7t%Hl#p}!!(BBJgY)eG6?i=tvmDA4Yt1s>h%Ll}ihh8+uf`;N!fomO%+FA>KY8y`7t@30A7Ld{gEds3Ov zFxT>ExjdnWiT!=`y0x{1dBvHh#l?8Yvrkpe)Xe1c%538s%*C##WnA9qjdG##D9Xbs zYJPQd&CJ=cr;JiwF)%EMa>vdLKBhQXok(W5!;{vk-iL91sIQ%8`@ z-Yd=Lakg};HbCe^+g;v5Th==HDQ-@J{`2-mMi)MpY|axbiiJ(}ceR3vlzgh2NVK#JV<%9}x9rCWv?rx0id~aC87<5ATzVHw%&*J^% zuzbi2J7>?6nS-;D&s(T}&fKE>_$p8$Ti!nl6*rcF3idH&yvLr?`C+H5LwE_?D`JTm z&B4qhYQ(R!Jh^kjDw16|W7pJ01(cD;KwcX7F==dNeR_dpXzX=1nTZDH&E=`40)rg@75+t(8u$!oyj zn-jPfI3PZFj+$s%8ueWa?l1fYCc+HGM2__UUw63g?u`hHo0_Ey=0aBmxz1DOw-5Bt zByq|UpZI}_R>nG=_6tA%|$baR<}E=7|95+y12ZL zY7+8Bht|v|*u{XWyp9^o@Ql;Yt%elxQ6>0Ny#*YtMmXx_oP<$N_tzNkn!>JYRiRCE z!SigDZD{3Hv1r&aX?%n%HEmcJTN!dtOQw;en_V6ji~1-Q!<7jU1zQQ}M`p-lNn^3~ zTb#JSQF;497O211OGpsu5O?^^zv`+1)zH+k7%`ET#bf2LN6;1p^D`PDEn{4rUnJ=E zKEvF{Z4Sllcxe^)P4N#a?PZAoA4YYea~S2BPM-J=*yc3cO6lyU%OCC?do>dSzslSC zV)x_&01eC`KQg~;*@+J;S2y+z2Yxryh@sta{8JrH0hpF)ONz!(N|r5RopiBvC?`UdmUDSp0k2)n$dv*Am+H`LoZgWG8m*z^yma;<~#;Q2=MWrLy;U7M_K zC`NBG%J`P!;}X(zl@ny!P#x=YV~K0Nf}N(1otvKNhIy(>CFxLF_&l_QxLL@ai=m~4 zb|1{f`mi0PC-+IUSA$@Eg6-g5P>cksU0$uM@AY$9>p@^4iz?$#RSs?Dn9~nmU@nZi zcafUNgxRM{ai5fbE-FQ4BRKTI+W6ui{crG#j>iu;j3XN!o%yq7Bh2TfNb~j4Pr^58 zz&RHbgis&J2!1jKRWM-IpmAs`IbH!p7kGCFw&7l`D3ngT=R>YLLuzn~tJyM!EzX>; ziL5=Wl>zF8Gjj_Y;|T7b*f4YdF`Si1m%r;VFb>pgR{pF!5|%$_jMf}V|6DA0P|w$H zNMF*0-ErOR9$;UmJF*5-ncyxU1QLJWlrcmMWfAbYvmHaLoU81AD^q-4}2m ztXwFA;lxnN73iJ9NmwdnmBC=0@>j1p>bqRY+q zxY_|0vA;Y23sUqfb8L?S_5~y5CV9v)o#}djz~&}O$!VtN$mf|8=6p()2FvqU2vofI z>@$L%$DUsK^2PftsJ`Jc42E?Aol}?>K}4uo@(f6nQm}%RoBbWoHTssqu5YCpEu=z+ z?&R)8L4p{>o@52z z-TT8Ikmi|Fe3cp$8C8vG;d&Y^i@j@X{FK?8r1~!oHyw2pY9uJo_!iFwf0gq~y+y`j z0ws6yMp$u_S#(q;9waC*)8p8OX$3**v5bgIRwUYJFm}9p>O9-w3HVpvWXGzRKB5J` z5kD4m^+(K=x!;s7uH5ue;#+^&AHr_&$4dNr?r<-eNwRld{m@(H#;KM5x#8+hv%CGJ z{mLsiQ1#pD7%txKOY9E zNMkxZ@FhWBt8+;|zPHIhcrE2LiShZRtj7Pa|NRFrIoO`UUGogch9=bEc6%K4=Dr@? z^v0fj_CyfymOS;QXEy1Va$f`4o{$?+V_p; z1dL{^4bBG+@k9IAP8?2OxhW}oojKD!0wC@g-i=xmhR`=`M?h;Pr##bZ4;2bG7h^jU znwPg0K_i&|yDos#M!P$sfGG91EJOQv^!3NclN6sW+8K@ZSDW%=+MwtT_{y9SktbY( zgXTYtzDS15wBf9->i*4i_-vNM{2=4WU%Z{QJr0}S9E(w)U(4Npbrt_|oWBl!$(sB- z{{PQtF@rm=UNhm?jb2a7$F;SNMm5k3{Y7(=_W1Sw1Qaw%_k^5KX5&JGrX~+eMPi*P zN@(-ii4Gpq@s)xCN}=q5?c6Zb|A=$2K7CjQM@mK$Jq`h1Gb2g=1zMlg^oXPSjOsH4 z?^a~F*Pl6qzC)#+L8wtmH+rh7EfV>;Xs_GCB!mlF|DvuuZDVJS`O45f1GXuf_FKZ^ zh4tdOGH6XeFM3!YePU64{oGF;;ePRdc$CpS(cIJ`K<4_j#o5(@!ycM~&NJsYTDH{_ zhCC=h8&KlgI&-+hPgkbK#`f)B|BDf~uOCuV|94Qyz9Ll)wp2NotP$obzS$}pXoTs1 zbuFp=pU>{6?thj!|6el9|GhLc)a~1`Rj2D`DAa?VL$eY3$o?x_W;efR_UVKFzlni^ zeW%$I`M;rMs|A6zjq5%=W>z#%w5_teeY>*pRp7r&9L6}*wBG(;@?ER9BKQ%CZ5aRm z34TMM1{=)KvFWFPm`Ab%TYawLNn`E5|0gua`cJ!_%^a#GZMz1=`F3`cOO>H7h7fM! z^4$FV)i}TJQpbzvmHWS7xtyD9ZVDSx!!V01$GlSBWk>?B`kl-5h=_^_KoZ&wboROs@Ux+^&RU7Yn%VZl|);@V$Uf{U^id@c8!W6`K~0JkmiW1S{f_l^_U&{+-~)YAwoP&r+i!z^Co2u&q$3T@F1SBtTOQP(G_nunjQDqBs~&j|+z zeGmD4hY&^Po(7hmT!nXP>$6aKy)ZL#3cx2s2G6q&C~K5ccSDc#IV@(eP*T~cXPUPd z36MVEjKTXw2WpqPb2+v&9RC!<{pZ}MD8E!mIW2R=qs6^$!EEaY_-OqSWn4%n0I8ms zQqWPdFPR%U;}ygo$!?(4DaW~n)s@t;9D6NOJ+9}cBIL=)HO2-s4b!DoL;BM$!pgt6 zA61Y`_W8KZhdYg|#aEtL)-L-8mU6F@*?@iIJG_E#b~-3HM2;C*EFWUjAQ^zC_gSAgT@+l zX1!}VV4KKezic!(1u3=V*H+UDTwaYJx7E9e7Jnq}58gQOcQbc9R#EvqiOq(um-kn3uW?&WM_> z3or5RJf(OZcIZ$l8#B{qoNhD|qe}GyF(69C(-Iuw z^a)X!eQ!KttK_jHPq1WmCOEG`UH?z#hl8_7uMN={1G?6P6d=)D2$~Q0EV18|WpF}H zZ6tKW>&)uG2O^LH5n)VYvEvC;Z2s%{co7RPvUg#P;$4k-Q#f)RKPzDCsWf*MZqizF zKTcRX7r4^EH!|k{l@w!4bW&|V6TG|9AOs@-3(1Ur@L$hk?ku z)ga@>F{ioC&hlZw$=yH0;?I^kV*g@xTr^qHPKnU4qo@^v}{-eWT*mZJ~ zL_tbmDr;g|J@ zCR}c2$b853C-_kaOdP39fqmhvBMC(Ixwcbzgj)}_eOZo`a2aS~4RYKEm)=k70b&`S->G% zE3WEIElT9ancWy7FPL{-bwFtJpX+P^C=2Fdsd@s2K8V)u&vLVK+M`s3WA`TXz6N#F zjGcAl|6V{Yvp(=+X{i+(qXD1$IJy|cwfnsBW8*mRzSvgAN2fX>VHz9FRhCkkEp?i{ znHRUtVbIGd%V@1qcvqp78-bL4*=}Z(1!x3yW!K4kuDd2sYtH9nS;vDNIS=V->mB@l z8;ysV(xZ{`Vo4h|fC#h}%tE@9Ox6VW`PE(B)M|m8iZAYmvb^{2X?Gt9=%cGism^vG zwdZ!IoJDAK%mU-&R=YCKUg@;pHI1qaMS&j=W+b! z;Oh3Pp(JAl)f)qeSuI*6EILI>NzrH%o(%hJGAgZvU=RD9z?wJV53O7Phb;Fj)2w~r z315?xaO$BVKKPhFRC(-`OgL#)#|OoG+yu-{jrCvE$=g0p**@eczJ~=`GqkN8iKF*@ z+q_WzI9D|I(xospedlA^0T(4f<>kHc11>>W*N(af7NKH5e|lhBBeIT{N!@^rJl1*b zOh|TX?XT3QS{G-h8-##`xzgkudJ3;#4rUz|nwTPfJEewV7#>K&VWjD5Qjg zca)FV%ZdgyAaBp5EYfDD{Nld;Xm24bK%Qs_nb>XkyK`~qmU2Jtoa9vRE_`#PCRvx{ zLJKuq$husAA=OuOGpTFW^tcA;c## zsi?o-$CL1>4vDlaK#^(oa(qT81C6oJRgi*`wm%Z-9rN31_~-2e93;R_K&_1AzGYPC`w}P{Nd(xVMnn07O*t}Hs|A_?vhjMvLr!NIOHKDtg2Wd7Z1G(#F<|&i#B%^fqGPj7excG;V0HAWFj2n~JR> zO>36qrNWd?aK3lZ79KMZp!0%CujnLaf%YlIWV0H>E`RLnbzkPvJsIK%qVCdanw#-U ztFQg;aMjh@ON8r*hchpSp9V3PVpN3|Bi^HBQeBR7Ebm)^@Q~xsWIjGCaBa@p*`xa7Wt7 zCL~tHCW2!>TTkwKs4#V4%G&YUVGZ^U78V~Kt#&(vVmvQK$(gwvFU{>wuY=dhIocJq zBub$M?*S1U_cW#E&*VZUf%cit&|;)~q^Sbhyo7@Qswpc&L{nV8fER6`DKY=!94&$G zlt%JQ|Hrd2$#^dh{WakbjTP(yNVKgDMe9gEU^PoUTy|JOdUoYlEMd3zX3OiRKR3^U zFgeZl>)InJJrAv8WKQ{bybL!ifa6Jbdsqo-duIu6Z&2*|%Y%vNU8}vIt7~S&1zz@^+=-{}e6=|6qk_>aepahgUSJ^RY5q(TJf%h`-Q5IbJvBi^V7>=rv z8Z%}R8O4>RUiDD8v1a2+%N%TiTS#B&Vn}btlCm>BH8qr4cp5@H>@^mQ;~r}&N}*)m zJggXY-WC(bSEP}_d7xKX_MFmhGE{~`h?8*xtTp?2xsD`DYnES4O30_^z|(x^cuw38 ztWQUW@BfuA^y7d`OIS|RL+GB0FXuI{@g35GWL)_8w>?Uqg@}Awt&ss!9sIY+sOPQt z`FjnAI+2iRw^x|anrqCADeIAi%kkaWKg&NVSbdU+$l`PVx+MVmMYma{<;P<3h^2%3 z=Z*?)S|?CHh;OCbh*Ert3XsiLvqZCO<#zI`$PtbFBC{VNOC-50DV*26NojaTjkD$D zF)ob0=)zXX`Q>L}zmatijzA>-BI#{f?W`j5b&e>51dqj^UKqYAayp8>CXdOZ$Ll*g zvu+GlUYbvY-lEbHJ$dB~(b4v|T=cAkx*hFQ5b%wUMv`NS{_$f8qw#$4krx`JJ%_ha z6Omr_dP2pQ-G-HhGM$Ele!cq~;f*7+mS_8qiNF_RG3orSAIAqz$MgGyQE;;>Lk&J; z{Swsq-dSf8U=*rpf0mNuAx}Z3`Lf|>X5%azR0MyvC2d8kpUnNZuNEB2U_PNI|?+KFy}p+(x*5XtK&Z04KuL~-s;ay zp|C7lX2gV^(rkQ*bymplOXfl|D0e5Rwqscal}xL#g)lXn%a#BCIksOpAgs*=O+ z*4y`J#`Y&%)j)5p9%J~!pK_!di@FxpccoF~C1h3#f0X3if~YRb&9)>dnkjQbwG-|< zd&{$jv4je9_{4iyAIlVNRpTxX==IryVf{{5MbRDb+I5)-R;7u*iR%lNBvRd&An{dj zJYvX~MI~ZzOQt6H6-C{WdTYN;^)r;SHJ2`1(d!QiTUeg+`W{k{W2WJ^ckr6)<`Gul z5Q7gGBG6Q@WSEV;ocwfnxioaU~>9L65z(3448st0o`o zaB1Nl-mA&hp)yD50uJheIeDua5h?8m)Wk|}5X<^;SjVPfrsEGN)AWQ@0}H;W*gVij zy?YlGrfKLfMDM=lA2Jq`Jl}hj3cxupZDih3O_+%+MLJTHkP{#vYEyH{r5(remEX&o z@h>l&AJ-ZhG}`(JicSz$Aj7X$xJGbG18ZW}m@Jj-w|~s6UTtIdjj#B@5^&o9cPywAVy92|@zL%Bh#rq!yI)of2gw2dwM^nkXIugHs; z?)Dd2rpAFA3gD8(lU7tX`2V{d$DWtrojuZK(%2kTvS zS0THtq`B--?TDC`ax?nqB#)2$fj~kJa`1yjVf3dc688}mIy_RqHIUQBb zGjrfn&P_jLl=|^XiYLvytSVntM>w{MoIi@3&>2^%3`6ZZVZI_N|EF;O4pTz{3c8p6 zgGe<6P+z9iYZA7c0Yxz8dQPlOu#B!kZ)HxlMH5APbBgE3vRNf}v|P_R&`*wVCZ zTDy!lo-Zq{naW3kj-x6mrjjEx`|vU*5AvE)B>-XMG>qjX5&Adtmqex(%j4?zT~B%} zc^0*<+LtE{F`>Qk1BpV#t5I4z_Y}@@J(GV8zUG@tXYMIzX7yfO7q(2wW64K-%6#YB z_nt+b72e$t_9++3NB?TAn^Hbqr(GxO8s)OwFO#$&r-B+I700ud?(@EEF%I`U83)V|j| z#-K&wGpTNuv-3QYPit@K{Zl06S@vzkj51J40z83JAEqHqZKkQS#=r=UU0%y${bGir ztBU(NZ^*&v=%0KVMd}IJ77FCbUaGJ@t=o4@J3_Me#j?EQnB6s{sUuQ0%;TWPu9OQ7 zN}G4#j{Q_{)x(;mhF!0s*8$f%tL<;sTxlkP#RT%O>aWzRmtB&oT`FKMlJSZZ52%V$ zx|T!$ub#2)dg2j`jZwGn6%B7ja%;A*&)_2>8x*|`8I+a}$}1O@mcuSDsY+3UG{dD5llt8{fG z(kdZ*n3V%le0m-HK}zEI5>zj}!kreEx@T4;&C>Uc`in0A)&7E~nn_su@so^axP+SVd-JL*jcc(yccM23O#fleq_~9EOWSycCZ`Kt+8#PM zmlhnfq1ME0g7JGP##&peJt-m;XNR2L7Zw{?qtW)&QJb?1IuY`o1KJXGYUU{Bt`~lJ zB(Jj2QbT{{3I<%8{JDn=8#R|ItAtCsB@e0R#Rgo5$$*Z2&pr9jepWYJm7uM{`>Ozw zkpX#y*fum-9o2_t)ZfK)TkdwX@U}7J1ru2Et>yXwWdKhgAK6B=Hue_E^@44p;w^1Uf(^1B%k z>EtA0Gx)}|)M$v{z!L(m-s>m+7;*U+#y(oexYgT#_DNPX&}-}}?`Mo@YjeR3d;80@ zAM(W#&)$z1<<`F|*>lF(?j%1&T(y^SK-+m|fK$-0G0_JnijjZbT4&Fd@H91kL6b1& zFN?*w4}@Y+v4ql9tCs452nQNt>0(Hq?r*2Ed$eA>*Fg+0KR~h*%-={mh6d4{(s!S! zJJ_7Thdlx?Kt~SDT3y2fR`lVgtd7bX7TbyQCvKhOIjVqtwSsyFrWTHCaeo<-&H#|U zuBmm)&+Yr5X++mq*<>?$;>bgDJ1(|TaO!Ol@UXDC=0-yd)0lgcG`MesN0>{5#a9^6Icwe@@|-l&TZCjP zqme;#X5i-V@{NY4Eo9SXiYvm3|EHJy=N-icA~Vi#UIGONlZ+j6xUcJa`sD+moM6f) zUHN0P;WQmWOKT_9X-dzVd-N~7J#?Y0+sz5slc+}7x$u=>p8$;w%rBGVH|n(Yo6>n@ z1XvSQIIp&Pe-D?|T+S#OAqR$Xb<}HOcs8xO;2{ytr?5-Sr~+6(&y93VM z8Nvu({y`GwScruINMM?fIJSn-FeqAknV7?Y$?3z*Cag!BPjnTQ#QgZT4?50H&>*gK z1v%txgwuCfNo2$nMZSK7%gHr^JcFt#_6_<2g=CcJi4d_??=~0h5pM&kabG5Db)!{( ziRRDAWRbk`?QuUckmu`$v)p^AADrox4wSYi0=p@QR_(o}Prw;{83C#?tr!^CMoo~VAgNI`kC53xuW@yn^a%n^OBY7eFY~#5{9F7;6+5-N$8cK^-UiAHGoWn1GOW+H z=Jv}$xTCnhJ242aH9HRfGO1nRKIoZ0h0v&01}7UElTTuOA2kT%@;W_8@)@h(N@rAO zfXnDklV-%ofF##zyy7KII#Zu~zpYQUu16=}m~M;2#CZy{4G!@r5Dvl%o!Qz345<(% zout#bJqW)k2I?NwzC=gcef`|JrL6wufm;i^Dp2MXk9bLW2H?O|yIfbC9%ddlxH!K* zi~Cjb`#*7kZh3v96YCTa4@qKdb-ETYHxJB1z}AsXdRrn<6oF5V)mICrtHO9RrJvE= zx}MHG2D+f22!Gpn46s1?CtBPE_3?w6jIp+hjK1*XHKORQBI6|}n-H0f9&9e)4m--t zw*O@OMMSPum>o7lfal8Lyo}cgz9}K>;1xb1u{~}-gMYcC$kl7HF1&(;V)@UB`X8T! z`dwKrh_|jEbWeM8BnO@uTgAO1(e?!*I%=M>2lsBwrQ9GYXR3!@tyMr0!%Yv7RhVXO zGfZsa&CV}CoPp=Ds0SB-uIXa`+>cL*O!+Rt|3Ee>??SYfpy#1ZhBh1g1rT$UDYbjs zlFgp%O>gf2iG{m9_J+$N>($u3$)6vy+wX4-oP`AhW?Zh_j;9;*psD^gAPP^`2B#mf_MxU61O(AjcIIKmVaB~Dlg9lqHhGSxN(~hfL;SF zE3=MGt)&5iVsSx|a?a&mW!?UE&Yba4!Xg9en}j&-c&DHFk^UqiH<;hJS5_A8OG;RU z#;*x=+pyTHCa_^vEI_C-kB?^fkWo>pW>3)O5WL|VS02E*ebTgyruL)V?vl~*^ zsu=~nq)L=qQN)`9Ecrn*?hV(qPfcpnV^;V{HAe@(Wjyb}hM?xn=+3gCnT;WE>G>9{%QK}mCvd%j zwB1)Y_O#-MRA_zk*ddU}g6(4eeAwn=VO(zKQKWyU&cX0f6s5;}2x=fVK`O{mS7;c` zYe>M?w`Q*;>O&bT)ve9On1Ms*=}>E>MK{Sq@7G_&iz%DZ6SsT?{m)pS_{yfj~>qcSwmu}QY-DTIDpYu*s zNs`i}GHs~=f-a&oCv}-5{q_kPino{&X;%Q|-nbc93H z&|~60cU^W4oW5fsxogX;O%LxTA4PiVI_us;HlCmUxy9Zz6J z52eFR07=kDZVD_K5B+!&@qvE-{9Womz-w~0P?%&eW9#(6f&HbAh9m>aPxNVI9s%r? z^UH>k_WSYk{nUDq<3Crzz^R^fGz&vjuW;$~MVKgq$lV3-O4>7`!AEY;GHRWq!!^?h za_Qr@+22W{GrzWKEx$ragkd^Y9UBWUJ-h2I-Z#C;w&c@3%)ye+nDp>H6hMGC)7BQJ z)>j!{VM7;*oNM()pxEZz=3J&++FKaFQK|Dh8Yi)Bpf$`3A)EF#0+X9I#fA*xZFnQ7 z>98@OmgRI;TX6r)W$zBR7`ka z2RnXr$rIeP^*pACq=t3JWn=8|^C4geX7P~J_<1F>*U0{xd4X4iLZF>qopqHC7- zCZ2b}{Ix7He3pg%VH?A{B`>!HQuK*hxD#j`v&kL(DXuU5=Df3Yq?NzhVLNk=`@4EE zM9g1b;b&;bh(f<5cZYw&8`wHL)5gVGcqOM9l^w16V(4x0z;H)Qp+=5P&k0PJLncwFoII#M?IyDBQBVd@#dqgm@UYOD^fIkHoBL z9{axxLFyjgpMDw~#(DWM&gqbdq&OX|=C-pm1J6S)UPrX?5fUHhvE~W>z0J<4AlCh~$7+8VZrdTK_mYXFl1Ozn= z!j66$YkoWV?r8%?dB&$oKX{7Z-Mv7Ek=%TpespHys$zxUvWa(68Xuo$OB&ji z_u9ROzHZlC3o*-p|DH}ZG5UbGN^RjYQI1fN(pOPppFpGYerC|9VUn_=XJbXcddlcW zL&vGTf3%{u{Yl4qP-fefjhGBuifh3MA0WWX3%WSpAAc^p^ou`{ATB%YQuQuTBo$jU zW0Q$o=dQ@hb25~MiHwcw{F4LV8-((Kd6H)dn`m;-qBx9-S@~`2f<%b8q6caw_~(!w z1#9L;OFSJ$!y86&)zngpy7Gar7xWJ{l!=OPU(>Qd+dN(q7M}2`o$dPS=s+7qi!gZ6 zgyma83LF-iFVZ6yETa&eCGzBz@t=NK+lg?Xc!*mIW^>9v2HEN9<}>lX{M58sHpV}4 zk>gCFc~9HXU?kRuYTS5mf`(FyDQM*gBTe|66_oC*C8Iiq>+|BvS}Lt#Okf38(q)vo z&3F=mLi!fLeqD@M+M;4_#g!wv?C82KzeTTYmG|j4Gz<+$aIW}FOOy?Tf}NCJoV-Z< zC?q5#Sl`f0_DSVKlng4SuCHR2f7uvL^XV(?o$7>LI+%OungkwBZ+dUs*NWqB@V0;3 z7nI>lDmgD>hj=7Bt5#=E61ga|@uHoW%Z;;|z+CA?(mc~- zWnUhDcquAW|5LG!nhxyqi{%)OV~B!sd;Wkgwl1Y6BUx0n&7I__pPDTVP5KcyJGbTz zpO%%PO!ajg(cVM+zgNrIxW+)A`4dsHIfk7R7oO zcimM6_h{Amj)0>x1XRL%nHWokUH&9O=+v_Cs#Vqq^*wqPPXgv7p|O^fF}_#!TT4bw zh8*e&Jf;Xd8p}c=-N_=&$@RpoUo7pmJ?72Xte8C42676{?`U$EXM?FLF(Y$|IU)>y zqvsCb@*gBBZho)t95nlYu$#q-CLMtZZ?toW>xE6z-|Bq-k^ zhR~H4mw%a@>#&=2l|Z$0VDJ`cd3}R_Ma(r+g2gDSzoq-OBY`H;PCLa?e)xMRt?r-h z=a_#Ov;GZj39Cje@}&7k9WELgp=3=Gzd|jo_$c2jA>FzQpw1eZxb$l2((;Uc?kWjx z!dGbJgSJHrBR_mFaj|Oka4_{!w;+H>KPz*}8v^U|4}m|yQy$RmS4_FhktoPX672TAr^_fR=nu_I=B6o?q5wVQ|mFA{fLSg5Ukn zUeU}CmmvkN#-~g)p)v{F4Y*J<{wndAY*XmejOW75fMRirs!;XA**#?v^V7U}1iabx zFY4QmjwUAa8Pw%CnTKg&=47eOOkefYtE)fI9(#v*3a+Mcq<%8@nA`S%pr5D%_~gT6 zYQkhNmID40!18EVB``3da%aebf5rUs3-wnPD-#Jj6QoPlYH*h*DGL9Q^D!Al#!O)s z4c*4vVqX!FKDvFK#XX!)2cf)4LeA#z%?)7>;I1)lHIuXH5ur4KId8LXhc znr~`A#ZhcC{nz!Gzx5&_HMlc7mN)BOGn5EMxn;CBPFO)x%;pTs#oHS^E^)*ho}g@K z-!o2U*dSqRdJ6YMBupykFTS%)T#VeMmHxP+rb6BQ^h3tvUxZYZn8ZRO@pM&B^%6rx z3o%N|X&4owG}uDv=gOYf*RMzYW{*%!QE(*D6MZr(~DC(sj9MARvqxzYF|J2^k# zV%YiY<54MVz+H9=Q8Zp`@gU}vwkU)cKg{ZcX8WR)Rbo!S$O=HV()U*T-z@KRUN_Bt zKcDpgodt>EMtI_gAz9a~G1~e03c8Jb+M1+AMXmWZ1q~qm_hJth6%~jb zJ9u{uYOY){K_(SmTs0EueWv`2^crvE$=GM+n1li|B}(d<0*6p+`7&oa6V>3v(wzz_ zjNo(pH^;Q*+PP^m8KTObV=AKDys7U#vNf)$Io%|!rUkN7W~u%<@l@Sx5#Lj{nt6pI z#th8#uIvvA=E{81<1sp8!S z3d)W{+pEnHYn^RyZ7v?XCZG><{^IBVa7^IO*H;v*8Rt~L)pP6+A)zpW7DwmX?gQWQ zfYbHI$BVxwCqep#|BD3#uq8pIloA+YrS07yG5K{^=9+dXF+45H?P86@vy)aiYed-Y zOPP3tbh0x3*}2A$(e*Uw{#-&Ey8*kCh_i}9EOy+qXjjznsIECX?jme@;q&zJyl)vL z>zYL`KWcd50o1S{3~N;k0lr(!;667Zd<8zWmJJKHbRH^6^@&dVO7NVXB2LCQBt?Ns zgw*46z@0me-AUn3M-Yvj4t}eqwh8PuvMsa6``ZuqG@ot>bIE6eFG^-6Gn1>`4cyMB z2<=78db??^D4R7Txtr+^aN6(vLpm}(C4Mtiw58TGhsR#4-Yqj|W#E@sUAs&lL5{q1 z%ic1T42FlR%^9z)oExuHMVxaYI$KW1p>V81GR4{oVbOV=tW0l*lcU=|`MN1BMD01! zzf&m!r5kRtAD}PZQ(3hvBp^@?^VySDl%qsGZv9lh9pG5^UBdm6HEDaYBqR-x!MM7U?!joM&RK@RzdT!9ziTdBmnE(N!uPfE+1#U7KYHMz{1cP>zVV{r2#z|0pKG z1_Ekf1w6IDcCSq;Q{*}y#<2Gp=HPa*B>8>(CsokQT%?~)MqQ3wslm%3oZlD*&*cr} zLJ2o|Kck>{o5N^ql~If(QODA6+DXBRm$S<;&LOWhWE;^nmrE!crZ;7uiDVU^p!_5) z$ePJ`gdZr*WG$k98OeX)A@BY=yrVF@f1ULh?}3u^2K}$+JIW~f^S^Q5D3;H^J)U2O z@|Ejp&tsecia2r5|ASTj$6xdPm2Yyub$uKF`a2Hk1sg|RZ}wOhl<>t-1(DacC#Uce z2q?3=&p7=(T_T1rFC5ej_1eEjoP}r3%xFgRWB%noE@}EKLk0$Gki$bl>2tA%62#X| z64~Nn38KF*W5B6#+4)P1P>u*!UjO}0P3C{RZU63Rsc_^Nc)z&27i;r4_|In6v?nKf zzdKu9haVG~1U}sR`=7;>)1HxdA5?d-%PP^~AzQW~{;(W)fBFl>cW(l8a8M>?_QH4d zUrlXu*|g4QfPvOw;i5>7ql(8TTdTWF9>@FV6G={4>iFAJ#6!24b58eNg$Z%Y+rUeH zM8LdP*GS`Y<7d975cVh4$ddrR28UdD?04M6#0bKXWwHBo!h>-Fnl6{u&J3Q`1c`cH zr9ON7eUKF@roxGK4r=*{mL3#StB+t5rN}ZD6m;eLJ9luvc=VEwcgNZB z>c8Ibw^AR3Jjd_COqOFk1LqCd^HP4=e_}U!*bz5C&Z+-{<^BH#hL6nDZW*!PFy{8$ zSDB2nDL0^`W=>Bg(P$ALqsHaoNXd6*>b+Ru>ZQpRC~!o_!g70Z&DKj3Z8lwQEZs|J zz46CFCJIFna!f441t218$n40b*g_H`mfmc2_*r@razqRg+Pp?K^@+@y{M}KP3-&Mg z=ep)kHi`!+imsQBk`4=R3I+V#`L4`8h`z+^c=(;@1A2wQx*+(r9>+O0v$L4f+s@~Y z6Yigm*Kdy@7B@Ku)T;0X&OfdeKhOn}2d_5K~WA7{JFDiM+X=+IevjE^G=WJSpw)d?1 zMRRVoVzYD!W?+*^ada~5pb<~l#NRBO>7J0hnz9oP-E0P1mOp%+7RkcG{QAw{dukY{{^=V(- z$J?O5C+>~i=5ywH%R40aLcoH8#1Ak%d!v}XaV-c(kRjB`$&-%t)V43_%BV&$W1?m) ze$H#%scN%0@Wvv22;DIFW_)VEP&FkKb3WX$xD|L_GB^j|FBnS0+RGwJG0eK#RVQFY z*@_-`$T3$0@(Y`lUv}wcrz;$+g00Ni+`K&aOiOiqD@Xp(4N2Z9S@-K6uTCYTCmKq> zvy*)R89Q1z`Xl51Nz1aTrYFLf-p!8&7iLA(v)3G~sZCExxL|OBP~=9ag!oYFb_q;;MFKDqDOeuz#@Cy_64dGxN^} z6US+j?(I5HR>u>}r{l%YbDPKMS|*VT&j)<7>JH=}QDyKk)P50E0qh+~%<?p@^XwNa(?#PFw>h$Zhhw2+!fQeH)cpADK3A!%>xmhXvD_WfW@6JB-+|j%$2x{8d7bhBPcXyg@XC$C0ERWl z2iW{V!e{BkIP>1hgDFMZrLAeN5HAYtbdru+VB3>7%YG2f(U_%bcxYdqz6ho7HdlA& z=~`XNBG%kys>?s|TgH%d+r?R@wb;E)x0>{A8!@bBj4u`Pud8|!1t81(P7chnbG)Oc zzY0u4muc2kUkoBeT4w%<-gvHT)@va1OC&K>gIjTIDw;;#eyV5#FSZg$zS<&gFj5z_ zJ%vvn5wUZo`9armcAH4uva0E~+4?w}^gNCHcu0YILy9C9@0HKV2+WLuHPTF|q4sr; z5*uD9Ikl`!`!Pdz!d8wbo`!3zh>kPO>^x)QSf!zUT3~_!-aM}AZi?WGF+}kAfCfz6 zUNpNKkj(?;zE#N5EP;{RX^&Ke1kaRV$Ca~@nVuK$MgEK>A_LR05c?4+)h4i5X}Bx8 zHZ*9~=_nFl_#?R4`igEvrO+`Ef9`+Wf$Sqrdn?_N@?0BOq)9j!<9EIF3FdVqr@STX zrIi%eRi*JT)FnXTAF>y<1aq1|rUz`}*XGYja^weSLH>QDjZ`}fN=cav?bjy<*ha+`;VBlW?5=b^q{+#rN z(2UeIxFO}^8@qDMz==w!5C}mo?kAns;+PlrGm<)pI@`;m^%C%SYwCm)2 z!=7?We>wm1#XQamX1>Cys7z}vymmK-;pEpV)_4`kH@$W?CtN&!`$sQr`%Cn}S(6UM zqWzN6Xr-H;(MwHvH8-Yg{hlH^O(c%P-Qvnze%M|bSW_7pWnU|@NSxu%WpVC&@SL3d zrIwTsIHLPtDn~5wxIq~m=B6ST`&8UE$5iL-2gomWPAf>uX#coFqc50m9SiXy?Q>r- zAP_bf!B=*eENtYJ9}RbHu<_S}}mhZl#WysIRI^@qt*6Yv@vt zmKif)!e**w{)K#ApKxljOg)CLf;k-?$S?nlCS(^0uz%M0JjCc{cvZcB(GH zrz+WyWoFfam*q7HdA;bmZN$wI@%AGry9S?mGiU)VE|ZQvrpV=8}wUz6|DQ2wa_4C0x2WHyx4wL;O5#L@Lrj zVUQ+%$7N84nNeq@sqP;8g=8I^p#VWeen8w#hG}kPQa@%ZwMQ?z9|@TgV%EG>AmcYs zZ7@_n3&m}u|9CfkGe+D%ks2wb*LgJ?VTUEnm9h;OQU~CE7|W+7{K7=E@^Xk=R^Fh~ zx^?LX#$=iP1go}Iz`IAQ_l~rRs#0umEPqzHYnP+0$?(O|CrhlhZ4GL;$1|9&FQQ& zlIOhj4q&~qfG$$W+b0Z_gMJ$bXf${v#td+KOTvS!FE!Ws_;UVu<_@}*?VR0o1b=~7 zTl>*8c}|1mrfx@lT+XABT^?Ds7?>sGx&-#?DU*y>x3b(de$H%Eq0yohfA&5)zAVAS z6GO9y$iA-(4+QQ0twTMtP6zIk=owY;)kFw-Z3@0|pPBKH?DJh6nxZzg`yx0ljD5cl z)-h^T$LqtF9*A0(6k*|Zb!*_DyiJFSj}5A7?40?0lD!uV}CXItLa92UG|T+#Mh{Yr`_JiONd3NsG8yiZ*6Kd-0e{>eGT?FoI90L zzpd!LdwVT&r;C7?)Kpimb@{vRHFs|QE$#@y9?n5@eMyS6Fraw4Bj93PH*0AA{*=h9 z3ptaORaK@n!cjYElk?C?1hiYK9hQr@3|twLUHkc{1XK5siZQ?txfU8@BsJX^h_y{G zK?FU=BRfxYbhb1#;fNaqd@@`3-cZiFzz(AW)wr$V6zkux;ZbWMum5d80zrv_fpy31y4T)4yJ}Z;cXd7W?69v&GMMNj=qM;Cn6h6aRZ&o$bEBX&n!5MLVzV z3mof%u7tc8SqQ2u$|_3m%`3B}Lh<=+m@r}r8E{O!EJL9_hZ zqWtsXe`-izB)bAmSe5>tXw$D_LfZl&s}v#b4LOyQ$CCeQ(qTtLGB%}CTS$%i*^Jsx zoa*J-YjqO8FQ?k96b9q8$!lj`8a`Rvf-poq;Kkp6oI>1k)+1$UPnl?+CHD^uGyEJh ztR(Uj9y_iW4B?{o`$UKPTOIvhOWcgMOgQYw#7a}+4Ia8Qy9yRo&ravTKtG0Q=xJ%F zCvEnwc=@P9p8so`A7DjAewq(D1Bb4)+${-q1D^DLxJ2x9D{dTfoBJyD%|^HB4LMl< z9Xq<1_JVV8dVcr2-Mh3A9FEYG%#Z;O1WlkUS{PI42cFVAI_Q07tHxp=Qr*W}jg{c> zz$z~H9#OabMV7o><9vt)(tdZE&9U6T@9(CB5xa8f+5{@Bi2CCe&dhwb!iDre1c8>@ zIFq=}j&iq=qG6Qr%_ql70)QJRdHA6E9)5cCX|AK> zhjXi~06P`d-)v8hUu!V_-prH9HVViDEEwRUQ}H|x>se5&Tv7Tp8M?1?T;(vc6v>Xm z;D*@1zgw$ZPGGs9;bloX+M5@TU~JtV()Ny+p-bmGVYjY!HdU)ut5I$2bJoSGZXoKo zSv!&9K9X*F$?_SoLGYPcL_aBwoScF}(v^62)U{Av7Z`&5_IJc)b@)a=@qpby(Zj7v z$Y8*eQVLkHZ?jZV-jNTAkIMMo6?X?eBNq{Nls3){R92;AhJ_E}^AJ)d>HS*C_Emd3 zwrr3|bAnEYJI(o;Hg5j=neB=~>yGrZM7ib-=Ia*wT#W80Hr<0^i+cEXMadHUGgVD| zNpHvucM3H>lMUj0#3w>+LsHmGOEVeY-WNH_F(ifUbHDk>gjNSaog{%A%$K#&d#+{=e&!gyGCRKLw#n~u2XzR^2pF5NE zYd`(i0j&kqV-RvX8OusqH0^3(9=e(w{`CqtZ*(meCUOhEf{F@7Sg_phV$Qc2DRon< zI2bWw@&ForM;XA%4~LXBjRRjF1`_SVS8oo^$UvQ}CZjU>HdV-y2IP8)n7xfmu76#O zh@+m0TwqG{o1yc#OlbRkU*9>^AwI#w@ob2_UMfws)`{;$*sd7+eD2`s`<9&BKkf1K zlGsTWY)Z;8({JvDeut|@Y{<@r_$EO7ckxGA6X1xM?~XJmC}`Z0N?*i%y}T80o-bam z7z_xR&I(Y*Bm1z02 zPRObS$I=YkP%$={~Vz#~0QxHvKDW8V=9KkfkW_KCRIY>N$0kZxh*T zH$u!WKFOuls;hF7^SG#C6w2y%+;4*6y2h(vK zQE}T9uw{&0M()Gl~Y<6_S{8AE;xA)DzqVQWsuDVO2h5fy`Ys?8r{2_Y%L0(({#8o zrS%akpVB^wqm2s{L;s>OA~R+#m!V2vxWi+AKbdcyI2K&|d(gq)MGR3aIm?pyh!XC- z#b&-)zf*+DXIAWc)bs)iZEvTUcA$pl+2-SH`>4DA#U8uSmAv{*mjuGhf>jUsFie^F zy-`O>UP@5{_;p`@6oE+zg5m@FjR1Y$og9PYRReo_<5{w<@tFgmS1ZPW3A+1B22 z!>&VS6noToR)8x+g^VLLIL>;#8rE6LO3{iqQx#31bofzQr zL7E6>jImR|ItS3Z4kI8jih!xRGtQ8k+NShMZ1iwslfotzQ^*JdqP_H#V5J96XjAj7 zUv_9}Z^91=?=4+RBit!|ZcfV(?G!Mes3=I<| ze71I-o@=BDb^M%#NNl~BRB`X^?DolVc2eE+*C|qFqugG2N!(@#8@H@Ge=A7tTkOr6 zN=Lu_&D{h$$C^uIJyMBbl${m_%`kCFPb=z(_sFPn@XMNmY(#|vY{@TU_cnL4kMQ!^ zdMF}>*LumFNDG>jCYNW)!5+Hs-afaNolW6Ns^K6e3jrZ2JnflkSBV~%RopiUeB2XK z7Q0fxY+y9soPrnJN~wO#l?s(ykV(D`Dn<|#EW<}aY`~=4pz(bE z{P#ikiua+v^4L80>klDd(Fp>9DZkkJjiYqrnKy9L?j$Lldp2LOK9|f(Qcg)SkY3=~ zp)K2VsFNg9F&MmThTAR#+n&|FQsiF$2PdDE{alI*qGDTvWauw-E};j-?5r&h*(2en z(=FUH+DjXW9E7JheBvYdRIuMN+r|Xdjv7)|20W59sxJ#zj# zby&6L*4W6N&{qI|LkTI3ci*;kMs#(X*gm790BXcVCX`?v(RyL&KKW*9|5406n`bGK zIKi;i0Z>(`2rCy`b^hEv`GqVjVRe3aYBOay_{zli$JlOTjBkgsb&foSW#Nv?CD~l& zYAeK3!`H$5Y+YLD9JTSQH!l8X0HCDmdZr;?_4B=RiF?qLfULs) zMy^ZA`3zDH`15@Z<6EKnkYP-}$CW6Fi+6Avlc~tG1JmiWkqPb~t}b(Vw9n6uf(tLJ z#6mpNNJ2BowfSiR<cXl&p#)n?5givWPAkK zc=^I)sn*{`eJN0@QU+>1`TL*#oYGap<>Ywcco7!Qe`a&EW+@m;PpYu(rx`!XuFn8G zx2>a4sp9ol@!~0&a$H?#Vjv4Di^g4|kj}5ISw7N{=AN7&97?BafHu@hiX%lNxy5xcl5&TTZYK_O9I2o z>PwdeM#s-CQ^b!Y+UF6!uakxozuVHVVQ!Ph2EFxGxF&8nv^mSiP0g9?97|epqN9jr zt22+g6;M^m|Ll(Ftr;llaip-b$xJIPHBosZZz0R%xd79>J=<5Zu+r^%m#U!aN)9(F zQ{O3Om0^co@dygFhQGAee`ZpR=83vGy*=Q3oQcdx$Y;5eiI+_lM!@5!uqUgNclv$L z$|v`f>6SzBabdt&D-L@g2%U69>#+lSlmqU!ZRNIlLh2vfC$;GiJD7Y*)>klPpt!wF za*SV)e0Z7A*-dfj;}^p7^}!1JO`RGv}X@W zq!y_*&3W^>ARN~8ZVBD=TW^d@`#ObTb(jYM(NsMK5iGzH^aanOIG|d&o zZ|L5+Bp1O8=-zl4WDwxWf?dT}yz6EQlA>t9Kt>N4^~{8DiGQd6OcDg;e22?{mjC-& z>_(AIPJw5o!UlV7OtwGX5o2$Nq=QN86K5G!!tp0nPdpH*aIMwH_T{W< z5Azah2vP4IS<2FVG7YoWUT5O$IB42zL)wght<7Sa^*&ko!KY`HA>LJ<4TYtznEWfFhUviv^Gv`C2w)B(*se|F*tppxg6T z@vq@}OUp{z)CIB-H-dGxiP`K;T638symI4CBTGBjNGi)k9p1U&$j{;KEKWoD@n`3w zweFChi58lFN>7FH{(yDOLgZ{d5ZeWt1=sO~_V_29BwMee8`NNah48$2Pk>!!zqRXo z=0dTl*gXZT!47ug(bYaqM}BT ziKA6%@BF?f$PH#5|6^%&(EZNuQ-g9Ubvw5pozS?eAyKhacQsN?YP)5*wtZ|I+C|qtx)h-d3jYjuqZ-JEBEJcy% z>IkK6Q=-iq8m@>g?HD`Hesk`nIxgz~h&^ht&Wdz+tu)xTgITtF=~R10b*_gBT-#q` z_9`Dg)Nhehmhhq%?)-@{q9pdLgk6pcDPb>b@+H{6Qj4gniKAsbiS-_d3Fw)X(}=fhRoqgA6Tazqz3gAqcQmH- z$vhYmR8+9&M0Yv(DnT@tIfO6E)g@9_s3#4rau(Q~u~V&Eq>eZH9Hk-1r<_L8C4Q5_ z6|-XI$ki(@Ctn%Q9wm>K)0jwOd6goV*1V~Pkqf-OtsoHJM)O~8J3u+{?~K!N`fg|d zlSRJ%$FV+5d?!7W3fKTW}JTFo#TrN!{2=F=cifpi{6Ap{42Y z`Yn5@rmF74V=9YgMrwWA<;w1=jZs>5W+wTrUcTZAI|meT7J*#ib-3d3UP#5umpg-5 zGxz5b8)m4{K*Q39)aVrRj0}3T5ra^}1mTN`xJE8iiTHI@-!e5Ut7`q?NJ-4Qm?CgX#+&P66-cNUOZwkuTmy zE>$dL1HH~NCLsmCX$^c(lWh-+MICFMwiZ!()_Q{G^DlfFELXj+6k5(F`lh0DOdZO} z8QiC92=U7e*Tk64Jw#S_`K9^0o8L>|S&og;P(e`#nPbR`X7tyHJ(Vjr_Kk=P43arxds zTioTJq?aE>712o_5*tsQrdF`=_{o%QYVHrOXf}yL2SKIa28Eo)SqiF5uh(EZ9ZP8q{&9#wyl$H{)8UtV!~#kAJp+Jp&hwk@+P{m@!`)Ic)WANu}^SA^Sav*Xz&T z;$DP!;jsmzf0gm;n(?|B)_l>ovv0S2Z^X}KtE*_;U=h*vxDKj9dO>tg*HiKiCL5tX z-85)@_Q3n@dZL5>;HaWc;HAFdmIJVu_E}cdflXERYYPYd)>m-MQ4{u<`IlP5{{oSx zO%o0lPF{zRN?561KD}@;%%C{xha3j8+x*r42L_gcByR(Tu! zf8fq^_ndiw=YPkcsD+09+kX1<<9`a+rJ9+odxCqOemKNvWJx&xfj|GCtfc*W@qZ3S z{vQLZ{|^Mw{^)wA=r%pST|PvAv^yb&-h`&V+=x0(c`lM(u3@x_FE6!=X-NEJAz!rt zE8PiI-|Izp^(goUOX>3vxf6_+^Buq3$r+rd2S3 zQ_TlM+(bNwxpC7qN{!p!n%LhT6CYM>?``~8?`Ov%hL}#KeAskHrM8`& zN$795#gQA_M%oiC(nbK{Nzf;0qGNsFhiS-k-!O5#5rYdlzeyEi=Vz7yjJYy2^3`{a#JC~1hH)B@X%kLJFt zBCcnOsM!fb(@AA42`28OL)Q(3Bg*+vLL3^kTl?dyhUo{&%2NrqhX_%Sb&FS-6Bft4 z@}byzCex5(1he%&OC%7%H`NY*YHiRx6FF)j;jW-*B(=Ft)}`!NF=0N!*-BRtwZXU zaHRx6WR{lE{BqT?n&(>d&fm~5HhHNvb_5gR!zZmG#g#flSF5gUsz>1nXL9$AXv)h@a2Mx~&pN^?O^+d=Ib=e{(652hHBFeriGhz*1^YYiwi+iEt+sDkxBUPC)?+t4Z zXAKVkv>$ClIAV0ab?4+Q)*}_uhWOUGz<@brf}sT$TULMYu^zmJZ1X||)rcy|ikclU zjy>1U{8&wXo;;jpD~mpWID8r(i}bmiPDMEUA?=5mM9};8W+bko(r2>oT^63ZLQS2Z zC2CmV`D^R;HV#D11!I{CZIj^@Ih)88I&oeg;DX?`91AYEaE>YQB zj8(~jxB&CqS{~S?rEMTCo>5n;fm@oui%idzU%17DO25q?3BMB4QZz4=F8CDkeLmv) zVZGPj00B+s6+1)mEjsZy9epHO`W^GqfW(;N9-iNUaCX)~(zG5CNP*wZaXtme9})c= zA9hA6*jL~__o`)UDh?1+ZUB}q=Pz%_j#}S6LyAg5bz@NnX_?Q(V}popnUqyG`z?#! zs^Ldz(VFBokMZ)843hKcb{|r^vpAN@CihHQ@t*CeDzwS$k{(AU>ZR!O4U+_~hEXFv z&XS?)6ZpKf6_~Gr_4I0%YP5m~d3(%G;8waHbzPI(-XI;>UuJ``%CeYGZb!<`bfIWdEUXy-?!K~5luhI{0RyzRvi>^x7g z{&vC13S1K>m2QnHaB~J;#K|0sV*5e}<0klh6Qd2hopd{5#EPkmhMzx|)}?Y2Lo6>w zDw?;r4?fbIR(*#y%9vW^sslVO$DRrzp>8u2_bbykHeu}Hz16u7-by-uBg3;v4kz&+ z1!foUYM$$@2~*3_E)ZXW?Ts{GJnI`fvljC{D1eVU@$$M>fIDhiv7W%>uBe7Pk<5-H zZX{4@y#2Z}b1_d@elvPHUv5)6^iF78Qp?w6Z74P-!empj)?i6R4z!#=r&Vw>uiZ8c z!VNFj7~Q5Ov*P(L77$F<`irjDDSht`JB=1C49cZ9?H5J0A$XIgSasF+Xh7$_f~&9JHVgAflL zU0uiFPl|?(RHE(edE?lz$>`bcue^k)o=l5O;9C6FlDS&D8jHc^XJr_ibiFCClV_U4 z@@Zq+OQf~V{3Hj}ct|)TibN4)#2O`CxURMP>B(My=+=`3sQxe_;ptowAxjbSlvZL5 zZZ74CltEDgeL;YCqm2U#UoAPWWj?0wQ+zr;7Eh6e^~nLB}Z)a3Q87$qs}IF(`Lsq%cNVx$wA%a$n0Z9LKz zOnXBz2c69h+k&h1|5{dIp+gBEqDjT8lv*2|M@qV09u=o-GC{p2J{1r6^5u zJc~*uvMcqOe{yr5ir_!NZDlLjxclHBR5c#6A%Ly@%ngxEsjt1pL6u!}9DSh?e61d? zViI4p*4Izb(fn=CI;PLfQwNzl@hzHXDB{ta#cL=o{fvv^%{gAvgSw}X@Awdc%+_8| zmka)_Ycjg-aXI?sZ_cN;N^UgT6SUNJH#-AzbXakOR`J1*FT_k8@wREAyxko)m(tIw z-a1}DPA1zI*kx|#SHY6PO&TU5Mtz7$GbZ_CZIy>UrsF9wG3P|99mc&`LNGss=2t1HPH zTT`2DfsR+Hf)tpgsiXbQRF!LK{-H4F5!4Xz70wDh8TW0=`E~&}(C!Ok)D_6CKdb~H zRHMftWD$>Ux8zI$E|SV^u%Hm7$FuwuMK{*p^h5?taJUemv%9EAw{yOwxg4{iz6b14 z{SM-tUw$sjXVxM582m zGTsW?HaB(qzQpr<9F1@X&|cuvF&E8Nvz6fekT)6lWXvDXpGM3X#wR1;b|=DZunddI zgx1@6WmVBuOv>xgVMFH*`-HS+1I3sW1<@Kl@|%K(tPCBGLAK+P4*O>G4&`!g>ivna zPay^1+QIrBzEC#!P)B)u#heJ66iS)bY%_Z3va)__ois4nIDUJ+{v>y@-41HZs4{i5 zr36Wr+X^lXzq3ggQrmn(Qe*RdDE+AB6kw!#(ACW1UrHhbHPR0e6b>i zq8%1PIcP^y5C^)Sp~*h7C(}6w^T9kWOL{v%K&`sFk?*#0x09KqtDeV?D(ys01KXpv z=dhMwOMD=3zXBnjam((}$CC(h87I&}K#641?>IvIBEOrfxyo8kqxuxb7C&S{2rD`X zApriG$-chojT13%#OP?=TrC+)2#M$qfkIkqT2%zL9QA-#2u$S)o%@*zE}w}$xSz2l zaXwN3HKd@~;?&>Ka%`D65q!DAaB5eR*|s?C^u*$N3g0+>-FUeXXgqGCKt03jS!>&E z4ud+lfq=Is@6&x0cB&5jh8@p!3+Q7Pd2ZZE$BM?X8Bsnys{!yt;!(sZILDsdK$+{~tcq8lFV1N-E=z$&|@36@`|S-mPkH4bgPn z_Uq|g zYW|j6+vXRt|I*5c0AB5S@qe&J_2V)V{y4i>jXWADDQ*1T9!Vo0>O4GD)e*5ez-^r5 z+L2eeUL#?M=^D?9&E_yqo7J6mv0bt%O`zQ!CtMV&eFE)U+6)UB~!SBwf>ismx6A_ZAaFYNpDdUy0RRS|4;bW z9@m39H^ka}*<0d=Jp~;PwD_a?tNJ?Lp;;exJPtORpn1;&tK^P)Y4qsfLGxP5iUV#M zX)6VNxi2^&k*sax=h8t#f~=SmH`OCJyqP2-EDX#0ANXeHSzudhr;RSfKV_tNYwB~r zhQ=i2^%CC#gB)Y)&uaOonI!)lYrboHybh7Ro%=#Z9n+*^s8f7>npb0S?gc4Z{(_rq zGF?~8&D#{1>KIFQGiD{=%SK>^Lhi;VyBPB90D|mT`r``Wr6^k2cT7F?-RDX*$$xO@N2Br^23Sag zVdp=$~d(ELC{Vz zhn9+sX-sGKms^%jx4XBssZ4S5;jPQU<%xlu`)D%X#Kpqv~)f zH5L~J#=i_Cr6}($rh-2g%&93BI0})3xroXG%SxnSzh4YbIhmQ*xi(xKh0(7<*SWqn zJyUnxQ;$g;h|B+-AM_5p;W`S83TP_<`(@*nR|-z7?h3W%iB0NO^RqDzEURl2@ae43 z@`ij5FneNouBq~5ws}w#s;q2p$oX5@wx`&sl(Gf*q~RNf{s7pPTERXF!9)zA3W354 zA`1TV%X#$^L3s3{%^7`|1k|PxtI@>%R#}AxlM5zQOE903IYJ(l_uHy{dIDiguZ?vD z54V>@OILo|ez$e5qLDhPfhYH1yx!(_VUvDZ(zDiirW)KN6taQU?`MjO%J;!0byP7m z%J#0;CkZ+Rg;S(3O;`7jxggsWHa4%)y2`@W9Cr?2OopufxoF=9eL_WfE{dvF&Ac%M zGmQOBtY&xkz#$}-w)_KIw53(qUY3#xn(3nK9Hu7i+`NAE1DMq7xkE_rglX(eUu<9 z&-)oRAYg%buWD@;GirMXBD!9P#8O5hNJqs?59*4-D$wONcq#0aszD+jNvr>5(mfs= z<+#U|XNJIWh%)LQ3d^!{4T`bsE_~{61L*JX{S`M4fxi03a zEm(M#x^4KX$Mo|yN>O;XFfB|9l+N+4BeLqWLq=!C0wCK|af82Qv&jVKawO&|!Y$mI zX^nl~WNvXb@Xc$wTzwXOLIoVG(^egVTP@m_@Z$0J5BQf3FEg0*JTm~;LDGe9e^z4P z0hQ@#SYNC;YqzwFo~h)BN9hc?6(2@vSH7DxuMrr5X_)i)Y|>-R|2*AvTriNt%3Puh z3svWR+7p_jduU#A2uCUvd~r^aA7`Z#OqsO%!z(?IXA1t7;M;RHE_bQmWHU~bkl#)IA7C@uZp5@QeyLTDEWw; z2`)W$AWBl!F_G1`P*82PZpPwx^5iK?Iz0X@?BIN;`nd)=tjgV^uwKv7G+5@gB~%Sa^%`d-&D6dZ2D0Mhb1(G<7W?cSi*<`Rp|j%xe>1hLA59(aA3+AF(|Qw9yMDQV|v7U@UUChX4WY)`R_8;t}n(ar6G{ zFLDl63J;Y&{(m{SA9@Rrj}V&^uEp`@`Fwj}UCKSTSX1$S?jtsF#&-nx#wvF z;`2Pkn5zi$q66m4xWkq=Qm2I4zBZu!Ivn4b(y+);rwy4DjItGkzvCliRENRi?V& z+zhq>sH)0Ai{&1hvVuQ|EC(<3)sO5Yh`*kD`+fQ<)s77LT&cXIJ8nk^t3F!795atX zkSmq^9T8tL3|Qx7o2jT_x8N-O3%#q$+^20+WZG#(_{lVD^PkuLHw%6b@86mW+IyU_ zr+ZJyK3X8x-}VQ}v-LNBJMVvd;{Ugx^8ap# z$nh_Df#|3k-!36}YS(+swU`7vGQPqNcUA&v=p7F#ZQO8b6vckOOgq1x0S3rEQ)!J?gaE|je3&pIwDaW%3di>%wJ0MXf%}{-gg(HHEdxOl1?SqeSWXUm-8Tq|I}!-=^X`##FA3 zgemo|`V79ndnWPimE@PLbN@zbc}q<)CN8V1_>7Ogq7U$oP~RDn=KYBd3w3#t@R5BB zGJcGe%y#+#9mg;DPtf~`)`W%k6qei6XPtRbOB7sBGWPkR61fZ=CJvz;Vho%iQi1NF zXP2IKA$mg;+HNx0#r9oc&*4ReBtYCBWBY$zVrUC>_zf9E86|H}DF<-+_aFuxvlr z$Gu9bS`UEWRaeMteSJ|t7~A_AT|OG@b1kvmsQk3d75w(mEuFRW-R=$C1LJNi#mwq- zMUfAttf_T%bru#DABbI!vP6JxpocRV7s1g@$CKsTw}fkE)!Ih}WT@0Nt>@*y4&ZSy zO}9=E#i)d(^Xg@W=;P;uDW@eS{VdkmCZi7@i62m(9apCozH z_TpLRzRNf3H!LZ}*R}Qa#8EGK)AOgV$V9xf8S%Hbx3R~}XO2L~n`n{pM0Blzk)Fe> zv>Iwuv5OIXuZQvmrEGo+ml0O4>rLDJiQi`Pu)FDkdAVEA17e8)*Ai9)_PNLCHKLqw zvB8z^QZ`I*zkkjI*8dG@gSFqMJ!}HC2UUiV+O+`iw;S!N_B3Q7A03eo+}vajA3hj_ zi+YGSzn?M)A%jnjV~`??qPte<_*B&-B?{b`#2$BwpNDa@LO{RB&Lu#;Uuqum5-(yO zidn8T(q0ytu_N{hWGBc8@4C>coP38jRkKdPTFBvEe;nRjqqsQV;G1;zwE@RtJ z6Nd;_qU}dexSp)JZ0FD@kgi+%13aT(8ItB-P17f4Tw-eydz%+}f?Yr~p_-Cw7%GV@(# zjdowp03<`x@B8XF%J?r zE+lVGYymD-wwD9NjsC5q7#1fB8hKUNVXS?R*S@zK6hcd9w?mea*S0B;tIJimS$p1K zQC_d;ts}*f;lo_V;dh>`&|cIS#Hf)dn9m0Y&&*rL)fO=AxL1M~EhVl2 zcmW~!e)JX-e8mAZG<6z$5_K#xsXSEtOsBc)EV8xI-Cq3Bf zvOvk`$Npu~O`G`+YwnzG<+hMLEipJYZy6bW-)YyP%+ z`tEIaIGE75@dDcRdZoquIyZ6LkmeT&1X@jM6S-LFof<{=eC3!D@!)3;hXOprEyT`F z+U(o9eAaKZYk?e3R$1i`b?o-8>p(w8 z;IiRXJ~hwcYIG|_c!>BZ-U`JyV|?5q?lVorTRo7>JTxUPz3afJ(V%7%Y;aG9I({5U z_${Wr*(Stc_CWhFsoxFu%Ulf1MWei>%G1R@kwxLlPMM&0n4(St`Ej{a^6-RdmVnX80hz$ zf~y>7JkAi5ruD(*B;S%R%=~uX4r8}3{2sCtZd-2W(wPM?@DBX8p(NfgtdvkTYIq~K z;!y-o-z|y$J+4DsDR$~4)co=K%ud{I<@Z5>1D?~|qxB3xk(wcM-%GsxOklSQLcKxl z0}dHud0@;tQ)npAbKfh|_`O*=m+eOA%hiB}5z8y#v6~7|TxrMyl=RQq&2fyho#cIx z_L=VI(>jXGsG~knm~g7E^KtIz@-iJWHJZ|evO>LN62Ad0@I{kV6tg{%oge!4@5U)B z%G1)bMcih8vJMPJK9N5^WIpZwXF<<~8Xq;aGb8&qjqAX1ad@1!BMBNB8dxEw%NHnQ zFjq=3HJLUq^9rjYp4xf)B}F}i6CyVqi~IBxwGox3@iPg$`hjZ>tP z<nY`7~I zk5{EMdZZns>azTxG--%HeMlhYsS` z^<6R~ek!$mWXe=J>JW|&3>oL{6O^U0aX#6YJ${rtbF|1;92x}*zh#NU1ik+G!g*X5 z)o_+3jHu6|P#IBcM~%L|T~4r>EssZA$X;CdY#G@&wJ8dk@0 zIHW9;M-6VesX4*j4B<5-7FVmQ7pRfw(`9n|36}WJu~DAi)NwJvk%J{XanwH`0Id2h zTWp94Xl`x}gXLk{P1Sl|7Wy#65j|Y=Re>S>?VH&{dyBC46df-AU%F zbTC(IN^JJyCtu#`YaW>B!vPmiEGg_b=UoedBFC8TMXz6&IH2x&kktZUmzqZ_@)Miii3w;~NrFTf-JmVCGB0$I6Ov_QWKdPhwh}C3~Y zYF>k+eiiBSsE1|X~EF1_<6JK6-H235C)O7boA8cZ*{sd zn3f)#_u!QD`!2Q3EPCsiZ2kqqhsE9Am}{tt=VE^y<;tbi`q~!;U0c!NhmJcr#ml3! zRs2E!gd&|mI^=5JB-@UX{>R+O8)`rwRI}Y-a{`NF6QOcU7BGF-g|(s`qqI{*-6~{{ zygzRz)#`9I?a_fKSiEi;Fq>J7McOLX^exD2ZhY>HE*J?q37X%mBUJ$8>4y;1FE3#G zNuS}NdDsQBpGR`hL=m*`0|)z(9+`!POwQufC~i$;SAXimel}Do-T`Px=JFJ2u;<3f z+*qr#ulPFi!8DTdZ7wi!rnmD{#rmJmTdg_^&xhd4i@4mo|KzPkFK`=m)lA0)slyrF zm5#l8&#=oTtuXPlUvKK8jO$bawq>gTlHrO!d-7B~YL5gCXhK*wq(;u3{Ty}J3Zq}? zx@EZL(d#MGmATFeO05K8VWIEKG(EuAU0aaNsTl!$&6=0DrrJgN!RUkG7}_v=~9 zyl_|ZC|}5t{x>>oi<@|rkL|nWF`3WXf-L3%x_349JH63jY2l=fCu3qT+drWCNA(1% zh?~vv25eaiG;B*PqLIScw!6Z%7NvKiZo=bC_;8hH;RT11L7CLQ6_0Hwo8Ap~kC0-Y z#N87HYB(xckK{oGUWUvEJ?;AxnIkH7q%p`!R5qiVJ;uQ|3}2#^svC~^e|2Mg)3#sf zQyLo4-k*t9YB_BqE|Ha51p12{yMqqphWYHuY^EB?NJh`1`rVnVz=H~(ox1Rh@8?e% z_Pk%MF3;#pALsVbk0o2VJyeoIg@M_sfSz1p`L2B4I+m#R=jYZo_ltF(0X-X@djlOT zHV;ACc?Hs|d~T?d6~c45k_w_xWd7uOLEc)J^{DVP5vL$pUOs=(rA#x{#SkZhm9+LV z^!TTxS~sU~8ttCKsu+@?65*k(4d%5{rfd*88!Dv-=eIzNjP+n)#cnOxLQ9rEM!F)#@lr;rk}m<+b@- z{}Zw5xS`CYbaQ-a5L)`vT=cX%(|zWieQ3tlQuibBK!dWKOyn#SN9E|bQCU*k*N5IV z%8r67qjcu&=oXr)cdp%i8B~bYWd>iOkAqb7{=FDkk|9vw-X@4epEdQpr%ESfjbu*V zioo47Hp5qLdwsfhfikmJwyF!Jm1Cs;i@CoFYpV;phEdu=DNx+q-Q7uxJH_4I-K`Wa z?gRp~xVyW%Yw+UkE(t%+`(5wpf3m-Q?Y)k2uvTWKWX^SudyH{k5RjrHG`-b8T82an zj|hn+fI!IUx>vMoG@fgiG(PM4?I@y~2#XV|B%3Y*u}-aJyKSwib!Fihwcy6eLWRWZ zc*MYaIP&br6ji6u)gE$fbLG#kd&gxV?gIW@lu9KPk=oVXeKo!zxO3+}?Ad66s2OkQ zm5OfFQ37smbAMgD|h_py3!d)W-U zTmawCoC^M`%Tx8}e)(4A=8JtuoN#1Lh4<#!RoSA(X|wl*$0v+~>;6w!`MbmaPQBI# zUq2_MXTGbMdfScLBoHF??pn_>!yiN%2R$42S7n@qc7=wjI6d!;!U;aWbh~AwUMzx| zTzWR4Hzq{B&x@oC@7Z_xOzRR*%DKqeY(aDc+UyKn z&JZMxt8AK|_hJ^A;lLn9HH19K%nd+dh z%NQrzwRJakz=Val<@(y+D%`Po_Oul$n0@OtC`icO9e2!sHZZ%4Br5&=i+pcBD$~}g zQeY16gAOY*LQsihwI=SxM*aE5l+X@J5bV3;Ln>F97Ru3i^Y6|_>6}%;kcTsxHv2LP zD{$wzebLljeQM)&n9m)(>zhdFK`So)*!5NeJN|)-(agptcTHxT+F-K?KIXusE^XMf z*0QJY6Nk4iqZaQNa<^M3XY{&B5^34EmU?$VtyM@jG0oixhZpn0{-WiQaH+#Z#`tZJ zx7w5=D@RSoA2#a{dZDrh71PVxkr$mD;B8QY7I6V>#uC#`(vgYyE*Ts47sV8@u7@x| z5w+6W|Mt2~t}xDMgY~+d8|G-M0Il*6nLkMZrlzk$2jUJXWd~&!o!-~a@Z6>6BU5-k zr0zuTO$6I{26?=Ua`=WmtyZx6U+--_esOJQ8kWN%D^@UosTz{4)wJ8Z9yxZuXz;wH zfPs0Gkav8S!4OZ1tp--|`3ukqCy$!OqkSl~qN!>at6)_J`9On;y8JzZ$F_u)s9}5m zPaZ-4G02^7ZSzgbyS3ItvX(kxM*^%&-MjQXn^KdvN29>zbqg8}y~%mQ5d^9FsoTTA z;0?KDp|O?TYA@HNVGml;Ac=;4bY^=#ni(_aZ2UC9Fw7Ypfy751_Qs?YrokjLH5u^*c`GcU@P3SpMPZ%5RI}-7{^*{#tqg_4{v8~=jCzsi`yV4F7(CLi zxBtTi`u|HpKr4!#26M`ksQG^|1Mxe}_~8ldmO`dLGkPZ@5)QzX)y=+W?^hI_8w z#b6<|iwUlU1Y1I$e!#X_+#CQ9OqxJK%wjf6FTU%sg;cCw@3!0_w)hx3;!ej%T#6 z$$;fvVf9re%|gj1#9-U{l3@_IxBLr=i`%FY(a9#RxLL@=s0Fly4@${H!^PGO2(i`fq)ym z_Bn3CgeTn}&|#5jJ8n4z)F6XFPOuZCaYgx}F$~N*1m@ z;lbzBA`fNLKdK;b6COpn3V##zziz%J78bd@^QB}W%uT)fX4cizH;ijdAJFOaSmt&z z)bPWGzbM2Z^!CQpHC+|!g{FiLmshVvhoHIq_|4S5s)=LrPJs#4>KHQpp+Rgvvswc~ zC7+SPWKl~wo3GPeE zmEP?;S6uF5EKlar?6S3dG-~b_Q87H5b`=Q|IdMHdxm#iz!_a7HTuJzZE4R9{o{nQP3@O0jsmY0md

)*BPyugdQa1o+v{tY3jL=@oF@O3YozB{@Zvf zZA-@(Z?Mnp*#i7(4I!+9_@p_z9n<&GGDXI-{~^kC{dzw(m75cKygdJ|f@vo0luH1Nmv5;feGEaQK65i%PXs`uf(2}BJTQ4a9sn~;cPXtxC(f` zig^V*S z{p1lTIIHcxcOQ#&y7P^v_IylOGH+}}OZy#RCWP6NbzE4Am>iGMi-Ob_Kv5$D+OM2z zxRX7Zp6IPF54fhU=cIhWVp!1p>cX#2!W6z-9az)5S~-Ff5W;?6djSSzFB-Q&M9My`-A2O>$Pb%KTUg^ zn3?n2Vjm`U44N!bmi)tT$FMOIF?pdP6G+|1!rCFBXURk_@=gIznWlMl8<9W?d&Uqo zQXlMiw&Kn7;bBejiU0*%LIV4i&VTyTpFg>nA-alnvTb_=*By1%i6_uE6;t z;};F-(KN50IcWrvFET^N5fu_2C3jY%Z3t8Oh&~6y#R<4M=O!QM!UZu$D`GtQh$(b* zLRCLz;xbt%$FG+1-qPtF?+FOqDATEpQYp#dee35)y||UZz%8@Dt^fhCwvmFs+fSya z31i@eSWhjEJoDNw?YkCsM>UToL=t!mmjge1%vMgz_9wC!uOO1hzxO%AM2H{L>oCJT zK{j*7b?kj}`Ry}FT#<}-?i7@@Y?c-?>aMP;&%D@CKPeyPtZk|mz-anp`Trwuh0Q&B zmpGKztJgcLPypwv!Julbw1I7k*(0}kUFY1{)9gnOOxoWH*?}zjEfrYj&^mKP_}m}< zEd!Vs{8deei-_#}<(;{jDx?59 z5@Yrn?u4eM%~S#+KQ>EFj_=)nVpxAH>GoVl44>F_dcu`7X4r`kGqx!^ z!I?tLa}~{{6kybyJeDYc3w>t&vsG^#zT73mkSRlr-ZG2kQP;~=?{f5A(cLzahwuBB zy#GiuKfAdUmiTYL+|akIqr#tj~I-6qpS+zFRb?4tW)_)1qv;xhqD z2i3kK)7GF9&`hMI;lX%;y<@rOZ?VUZ*;R-8jfd6tR);*u7uLk@_@J`F6?}E4K67s*_zjh1?jIzA%d-~6Gm8_rnTNea2xnSQF)d6usbX5Y} zPT#pd3UXDj8GPFclLhNb-bCy*Hv8j-i?^%+NJC~UBZq-$ z#!^sfq6z9Z3s0bn?h(Yfk4(%0*_HAwjvDE{b8+OufRPz^i!R|hitOj6*61SgzrLAY z%9v#g%!kImfKnTswsLoqlSBIR`$IyEwzxdrH3clx!aDZ){{H^@6?z68ju!@8kit&g zxs$uv=Gh*z!Q1$ahRLrivR~yQY4St=aIt?M{|`q)FlfM6FX>QUCthG)33h*&mOB%V zdn0d}Td`C#(YEIpGv)wRbwVY@^n;hpZ0xM;?5w7b+}?Xk^PLQ>e_&{6V91$|NL%le zGET^>X?fZ$|~?CngOW$UE%>*(`|v;_NqWAxM4FzF=KkpxYhi1P07!dc7r zOk*O1bANxr@9d5@+vhd%I?4RM8^1XioFlPz-44B6u(ARo3n#GNy+Gn*)Jlva~I)Eb%WUYdP-633?jV zc+vmYOoQ!aHe4F^^1EUjx$rvC^nIOhIW0tc+Hun77)HHQQc4p5ZTrH$oo_sg`$o)D zTB@DTDUN54?0UKTLd{>EiZA8PSL`R^9V2z0d4 z1>%^q2`r?bZ*PHPKGIR>j@2zL#hf5u_Hs8r=gokBY(8#2 zytM@yvLk-Q{mw@zuwa%6n)UqpLcV$ufr5SAdP>D$lHZ08=K)<%)FAl?1A-ef!;<|I z__K#6QJRWB>l|jvQnXS~=6E=!?qF~glLBP?5f>OTP9kcLv}eW)dBM=o#zg+$l%U(} zwY7QyA%qMXvAan+Oh&JHUUVJA`FdVRd?1_d!xy{xZaYw99KA?Zh|idTys?SngUtIV z@ezIO?uXDPBR8#yuliKg3U^*>bUz>tHO`6|l#GKc=zIubqh>iHaE_47WlQqb8vF2T z{N_gp^jvVp5wG#(1IFaXrZXDdvPWc1rxj9rYx}pkBJz$@ctokCDu_pXxo$JDR{fvD=)H3|+@$DNW8cRkyT6Jay zll$vMNhNMzk(l^3W@hf!MdO^$3zD@n@@}TCxW2!xgxIt zT(v2ZEH0rcnqG50pwvjrST=~;c2@Cb*XKy&`^GSW#Z0Q_W>&*-ONhhQM*1hE?m4V= zeuHqnkOhI1dEyk}6*w#fh$7YAC}B?wCBj|&npj~@Qk5nBXH4k~Bg8x;EF`v*j8#L6 z^2uZNM4Tk93v!E5{Dm}lM}h?Yev0+2@MnRrUo%lBLg(p0DC)YAKr{(nxv)6^;`h%j zTz2z7lq;Z_ibc@ZSXnee1`1`|Tv$N^Tx0+$6#facJ+wbv#iDGSzBn3UN=YfYDqLk} z4XvsjLt7G~_N&tId%sntGLu41exfi2Q0w~+ow@#^A1+{kUQbjIvxM}fZ9Jn33S zNc{bDUDwM_p#{9C+Q=_Uz}o`@f@lV5cKcSzg&NAOT;3p)-(lwhXAKlSPxkKuSD8Hf zm)Ak(7EppGzwhr&sFf`v|Iy&;MK-=!`7#7LL@N;Ae0hI@n+vH5a9Rmb63=x7>wREl zaD*Q7V|?}quj~@W?;q*hpV7r=ro>$}WTkb5bzZ*F(95RyUdrqk5b#Y{mhlP+&-@{f zI!KG()=^XBWvS>3%EFwXoTtWRbvCd7_nyEl~ri^T@Xr;Wo9NGzZ4PEYup1~Q7RLIG~W%W3=LG^o>N%f)p*!HtajzDHX5gFqyqWEJ z$@S;PEy)c4fTjZsRq(bh{wK~ah}N)GU6xocJyBZVtn-n6%62j-s_kW*ssQiH0`IF@ zy+8$&DF4Sxd6A7v9p_SJz+!RR(wqDmp0!?5OO;A z)0Cbpz&>Yeec}#mMZlR0Ca1tG1P8phf@-_`+=fgTrgH5+~DZT@s z0;wMB_uo?iP4@$clgFA}{?6o@bq_OyB#@cxceCPW+Ro^J?IZ8b1F`zcg^s-{6qZG= z!;yu+*U9v!=|ZK8Wb&OF1+X5HcR6lA9@lJ~3LZ@s}eK$qd_AIUAGi%ts( zqL*>XU&EngxKf;YrG1;w144W3BCb6NM*_nN{Z( z|HKPr#$y@;s8T0@#3h0ruWsRT@xpJZ+>d&t+X`>XD`8Wj7LhxNX_Xmin4(fa4BfrJ zrB(I2?+xvUZ6(~w7=3oma4P#S;9g#D`u6m96k~{Yn>@6PrTF|Zr6J# zR;vjyBuIPlQDVT$YCJybvyueAs&g4mQQ*u+XibGAvGr_M@5R5^>OK02zrsiT^dh@? zocuwy%|AuDe);x7bC$DlBB%dJOzm|&!>S&g5qA4qR}rfQM#shooD|I9E=P&aEjUmN zV;j~IdQTrs&Wt52#5(EGer)7CwikTopH@le2zQitx@)v)X@08l>+xHpPEp@w*;B*+ zVga(|CYxNZw_m?2crS0{nQ3-JQf3k__~(~89=0kBbp_lv2hN_py!m+(eS%}D^0dzG zD36Mxv58pwJhkaCJt23~A?385MZCjQe*g}5v>SPOumL(f)m^aWKFMh~cHQU6x-1~Q zL58p?PCeU{P4gqoTpj(nDYYNlUY3?(ni4?mfc9soKCn|&JjSCRd(@)RhlL(=-v-}l zBVv%(VL*{gMH}jh)jLk*r=OcHgm4hgPA?O2p?(%g&`_k2!ms)ZV6jxH2BxT%&Dbr! z9nbQH+<{>U1TkbdGyzaAg|qdXrSHaPyu<6t3qPwfmLYvf%lKw8J`UH45-lZd8s?ew zSL+AI;OApT-7DREu&uOgdyJ%5(u!qMD1*bp7qL$b*BV;Gd*PH2h9S6p=jp6QVC z2-w|)SaW+{q(b&+oHt6#Y6r}+M!N@aj^F64Y*e*(@&>|m8cZ%0HJr!JCucsln z+XU#12UmAW$NB$Ro%f{c*a&i2if<1E?8aF^>3F8+1g0w@B>{5wPJQhV!4KV`6smrt z!=TR6)XHlJpzCp33_PVvX!Cg}ta|&mMS-*1kViI2g`-Odr|J*BtGYSw#zIVZo%QY0 zQ>t@q($~+e+_*RcNFUoYRk3zkI;T&&gagE=D3=$<&!_${t-vCO=j}`fZh%XB9cG%n z@@Gk&r&e_{mB({Wa7{+W4X(ECBT-M_gYDY< zu7MBUF~m6+VJAseD=Vgmr?@)u+46KUqgc-t@l@0@AtOL`u+ZSj&RxZef#1Ip(#uK> zCd$qbcUuGJ3DT}oVsnX%4kZ>wt@dZ-%~V%&VB$CY`@#`)ALD55b)+Tw87BcSfyE_V9=N@*NgbN=ZktS zM7D%PG37VEn_t!9zYtS~ak*sWwZZIJrQ_QY9ep=g>T{K?QCoI542>ZTe3>G9~}opC810i4sEVC#m#y#@U6kcAwVMZtyW< zjUH%8bDvG$^}&gJSWo5)y!+w89rv+Nq*mkh`5p*aF!m%|Da5~%i7C)^=;)gBK^pcJ z(}wUq2rQ)9Jt${gVechJj}`?F@KiZ;ULM&Rk`ox-spC%?#PHEb{yQWmT!1rP-~(Zi~oT^Dc*pcGGS$bp}{;hnk;QKsOp<(j%50- zx=6od$k2B#$01ecDLJXdw|&qkB|^#22wGUA;$qMoF32UJ%Yxj;n;;!HE4_!$Z|8t7 zkgY+ip5fv>l`IkE;0~N4a+$;+lh^+BjQq>qF-@u(IxGPx42)hf$};0icH6P530@Hk44eB_i*@1%* zd`z9t&O5 zBFJWBWf2uGa0)EkfC+?i&VXiOZY$zSCSW?S@2J_wD6z8Qg_WxA?R1&Hhj;?v`p$>p zI}9)XE(&!*XM#cw+tbywURyb3C`NRfe~vZqUab3qcz8Kod$4H&i!9FgqaT|DqtOOn zvOTCqY%S`hUj#qjXus)JRleJhSFot-+QVx|yc=(UGGig`FGJO>KBEukGtQR@8$>dL zM6a*s2~m5p6iG?Jl7>Zr{}?nuB)H|PCFi84ho}7hey?7^+n#kC;#Gf0EX}Cz#g9nta%`Ith~`D|L}{r_KCn16xgYdF47)d;#4{ zQDI({`L{ojEtjS^E&KmjnxL$c<|U%9&9M7euB z&kuVK60pE$?5wT3(>%Pk%7q~~Nh$b>73F!<6BD-`0Bh_C9e9l&f@*pC)aau)6XMb} zO@-I#;=TvSoCn*KtJR8A7I<^0lkk*OJA-WrHxOd=PCpOJ*b9TS)?>a6Ca2yVBuyp; zSrh^l)w-tCw5Df=1k+&GS~0w2S8aW@joH(%yFJ>CfD%a}#k_|mCM~6d9^y`0r+EHf z;C2Z{L@_#=0obwLRW9uvje*!e|84}-K?XM-tm%)%{YTcL3aP5jmzV^(yrGJgix_T5S2WM}e=ewg%KKD=xoEpq z^-h)Esqe_N%zwSIm9}b zyL#v2LjcH?0H!(x`phMg>+8b_qL8;W_K@1WglPML%A8-j_JW?WZF>*k+0eON5~+cW z%{uvCE&x(sb=edjEtoxm_sG2G=va>D&(bq}Z?-*<-4kCPupJrnnUd}x^~J>jpI_$o z-EzmOUw=(IFu+vf?Q9p@ve9P$u4E65t7Y~XtOqfC;3jf8H=& z@z3(A3 zrf3YA)*fTt0g&YTOTq`h^HYxw^R}!R2QZ{ixWRKSaFI0U&&iDP!-6Yn`@LA`VC=+u zsgJf&lasnQk*0!W-pstb#@@{)J4cbqX})@H>1fiCCB~7^(fTM2XAxV$91IEw@dBY9Y#Tnz6uA_AlY+Pz=9JvdAO>1 zUKADv4>?7)Q>(KZ;e~F;3A74SJ&#XwDFD1UX1XC;Dmmqzs?D6X9IhFYmQ-fXJ?yXR zTz7kN$84erUkY^{^ZAXiHe(SnvLb`ZcHgd}CFjOZUtKc_9*6&~fta`!KAsYO{34$D z&qrUhCM&QZ?I-RoX=iTmm>a;mfI-`Y8hyqn*oq>-$Lom6a;eC(V*Uf?U$_UtMpJ7EQfga88kr7cZo_o7LURkZ$3$`3dRyp$oE=Rk}uo zQ$tn?f?NQ3YduNTg1qR=u9ma~O!U;wl|YsQMx->=X9u5d9t=4P5~ZIwPXq!bORtn% z6yOw$y>6(x?~L#p4xFp7TE>zrwR=4}IWS0WWMkd;;tA5x)%Eglh2X4rK5*@Bi#uw? z#WT+feSo~3Z)!$=6#EkhsSd}nE|Nfj9@8LI2fpVj*yyzmue>H*{|MmCZ-@;Bd=6a5 zG!DUUHZ%S}?Zh$ai1Rh&zjO`E|1CC65XmHyf^N3Ag=+j2h3c}IQu)Nji27R_uHE&9!&R77$nQoj42ZT!-uI0Yu8+Q6DI!$ zMzRqBe2DApvOR>n=X@v-^0krb zRC4iD?;C(>0c)qp!+-wDjGHbMw{gXmKzcn@;<-#cxN?pS>2)(Qvs1|bP!_eQuA4fW z#<_;kh_;f|kZDLu;r{B!8Ff*$WEvk~{bGq48JPShzJFQ!38}8OR@^Qk6b6*pjc6HG z=u$qqYr_aw=Qlq(wZk%4TWc9nC7PVhvga95y6Wg5CF|@5ljRC4OJuPUbZbq*Z`fVrehTX#b>OQM z-v-(`wA^tZVDbx&c{r>qYZOkaiYBq>wppmR8qKS{ha{c1K-;q&+e8qUqe+(nE>$tB zM>JNic7Kw3M!v{q$Tp{mx#ewxh(&a9WeQpsRJ(uFuvY82xhboC^_X=eRAjScOPVrR z>2Ib$DYimS-Xh&|6&0k|C206mk=zuv;70WN$giwcMk$)y4~6a zUKXVT6kTj;Dq&h!{80~NLD`A|h3Hqo11bc3tEb>s1X6%(RVYr5XUT`R|`6mpE2bxC*EifjyQZ0t#Ke*yCp75n#+J~5=2I5-&n#$M&Z zD~l_N!S??%OoLLGtG37E;&wo1s;C(GqNEWLTTOf0v>64XaH<0K)=`~X6d@ML192~# zlNF-x&f3P=gFc~)5=K#p9IzJNd9@Gaj*Uew1v1KB9A&dQdYujv<#-;t{*1pPqRdp3 zMIB&W?uuJW63K87Gm)pb>qdbY@&F)&TFa2OLN|0Kps ztTJ5i@P$>3+Oi)rYq?U9cqBLbHOf`}01~sz&w$6|5cgFkeBL$v@`~^8`%GH%x%mzJ zY4|pBft5D8B*cP3FMQ0Ug_HHVIR>))9d~`6n<80Ut_wR#H!F>S&38p}N1nS#`iiu) z{uArAeLq(JR^-@&NnReA`P&f|kLrt8K}e*5K7~JgPuD#?Qwui(fKKxWa8I_HpaA=q zeU2;h73MakBTp89AW%EAF~Dtw3{ToZ>~hwzqp8|8m=%4y?#PSzB5i*YGOYKZ6WQK( z19DpL^hEq7ZRrMWH@^uV=#|1T*4;W)!Do5t+d+-UGS4(zbta?tkYIAnU7u;RNg$It z)D={Xr*b<#=Hf^9Y%L9e(etS`>XF!AbU>y~XT@O`h)&&F4wp9J#3L|wucM_SXJ84p zJv}YwKQ$Yalp1dCNb!MBkaogLDO$0QpqG!A9JpUlBcwS-AWPJe7q#_wFAB!N!KB@J z(6BknQ?#0E;&H*;q4J9gOC_VR))Aakv@lDh3YM#J=Xp$8MpLY)t%)JolM8vYbE9R9 z+H@_IvF!^WXUj7&5s!@>JvP7cRe?Q2uG-uzRxzN6X6gq;F9Ea%Bm z{v%^@nWs8a;O=lsD1X8)FlhNmNHz0AW;#01kc*c-WC%&7%g!35uC38^8(kC2!V7wR z%Z7OG&BqW~VmlivjKu0cQCeI$wGm)nMsIo6n_uUeIJcNLubOCa5G`$i>C~8#YHONS z*}}vkPdB1n%eJVZdvdZ+5JJN`HN@}>%fKvgI`GZ^o`wR1=Q( zQw{})IeC3}XOYUdfv;v~lBQlX z4`gB~8YtGl(_=#M-=69wX_DD2sqsx%a$svYVp;*$@ij1{1Yu`k(*7mT(Veh7prQyJ zH1Sek5X(Wz`b0s=7h>a}QQ~`sQunv4AP#H%{_fbPLU>&m>?2euk`>(lS1C6*QJO3% z-qmPM=)Ky9^01Tjdk&q|iNUgUuAm|rOlaz@W%PRtb+x5T%{(%O@V$%-x!E&Mx~K&Q zzI=8UiFhGd85}B$qW$tDvf!u zD~bqs`AuYbwBN+TNur%8q&(pezhJ_4N2L2!WO@RBzNPAy`Q6wh9jc%IuLfzSjhh8A z_*e8NdK6#JZ{uvAlP6%(xdeFAPq@ckK*J}qC-&?nA2Q9(iFqQ2%srn5HH}O9_FM!Z zrWHaY;xt=5q0)Op;vu2c{7@~+i~sYpaKeNl#0eZp(zNFekPoyo7WQWZ5QP^vVjV=C za^;Wh?B)~%{v?cGF);HnQ}WsWBPknd!Y4_~3!JO&#YGQa=k4ij2NRVCVM$RX#;+b{ ztZaYC5 zdy}rX=15OLI7PN(==e&G>j4?~goVPjc|4HCTjgtf>c-1SqGw%4e<;hvIee;=(lo+y z7b0TP2troi&Ri1>YSxBI)a0im+I@c8mHJ6PrWT!O1)ct}aHr4RX6VI!B59JemX^Oi zpXY|Mt92YWt#C@9v0!_*?z$segoo41DDrRqy(AHuxXodar7}(^2CV;RN#v`Pb1ae( zZ6+u%PWIbpXH4-)V-jH=^p>5m2K~XT1;G30v4mIX8Z6}!3J6CAPX@0VJ7WanbLEoA zRZ=lTg@J@w4(DKvu0Q6_p3Y~BEDmNuz^jga*O3OTAu2S7P36o+Gz4UZtiO;^#`N%Z@W8O zL2V)do@q8#dnl~I{4qLFZz3E?;Y?WqhJNqN---Q&^EDrx1K;tL<@sFUi)?A*S#z1< zMyxKkh`&eD%)i^1WPZZHB#GvK4rR|eyQ95NO?eI&E%QMKq$>!gg~rDZS?~~?DdI*F z51NB6;Ek%r9EOg)9<5`+F8zL~T{Sc}CcVLSS-(g38%1KdJj$=~9bC(Dl_kDTM4*_X zc9292ojGAz&qGH+LucY%79i!F`pf7g>r}l8X1LJ&y%q!*&RS zM-4QD?}w6(k=i6kE2l6ct&YN_+Jh=OlQ4=WxsiZ1^H$VrL~ftN`=J2W^QyU*Ey(He zSCpdd(s|Rx=K33<=l+=z6Mo?LwS0BPS-|SkEM_LNyo?R__$yy%9;$q7?9BWUmoCXk5Y10m~|sdgx7z_ z_EF<$a#7FiA}bj=r^9>mgr*-`ie{qoZZWdd;gP1n&I@YT)^?e>7Z`XA&(R6?Bj-I> z)SX_enA&{c|D9F0A5?IZbZ!9muPOHDoi#_+v*d}<+3?>B_Phuq78&8AP(I&z9T|C- zAn;N3YWaN+l04e*Z8bj7I9OGE-aV#^EWD&+29GjoN}8f&+#iRL9YmpSAV#FdT4x1y6@e@@#>xanR+pK+;a1r@@R0xX zdzY3k@o>p6&#-aZL6>k}1oh~;wXoZuclVtoikQ$ zw~h8?nIuDDe!jrTH9Zpi4qxuU;<}s@Sf@ zpjJ-q?s)Po(297SSQc3Ae|o?URh?#?SXPD1b>=W66VzqOAB0hxG3)S9CMbC{Vt3t4 zvipzL!aK_Eyl?xENr$E1nTu4jH9+~_vlF_CbX+*NKzapWosYW)->0^=s_mONo>3W2 zhnMvX@l;1k!2rL5F_R9rg-=U35oeuJXTi3Gv`oHES&mzC4Ypy4cbmhimHL|9FQIW| zZ-?&LEy02ZmAaavhj|JD#Dp^Y!?XJlu(vnq*e&zan|@9l`}b|vQ|$ytzmi{>P%NLJ z5q8A1sCJu%Wz)^z+{=D^PMnFzgFM5tqZb9T@chY4h03Rz+_5mgyU3u9YB9_--2HWI z-z+Tgl73Awszs^FE>W|%f<(wtf|}R^8*Xd$}#{4~0L-{IMwJz+d$xGRc#s`Zkd6?qVzi&e}JmSkvd6Ty`{d z1^RF+TD&ExaDi_2cMaD9S>@kOR~6050LruYO-wG}Mc}cAfAzcZWY=y`i^}g3@3;MR z(sIvrciqa14v@HIk|4uEVLu*9>I4@uB5qQEg+qqbWa*2BB*(NP48UhX-`3)Crs@|a zP~&GI3N>E?8J+^6>Uz-KYVxcEBk3d-rGl=1=K8UyU$Mcf=F^#K?-@X+;%@{-BIiwQ{FznChajXa9#5hh z_(Q{>p_K|d3DrSUwI%{|m_9f)IVGet1o;J7f5f;rx4SzQ>s+mp^T6>H<#(?KXNjUv zqExr1;{mvYPbsAn;U{;y)zMrDNO!mx<;O{@o)E1WYZ@dK9A;fkUQke)aVGw z$=`~mURF@fR%?s?&Pk$V*8Ce(w>Cj++@o!T zc&Su!wW876O*VK|dKQU2RbKKOOq{X z>Bs}`GVnQ2@K11kE$c4Oj-&wMUewm}EsfEhMpBkG;LDy5x_C>a>>2i83s!AT&2m7y zdB0@F35w&gfpXkJe7<(s5>DZDxIGpB-tUxRue@K_lI%uZt>7!hMV9WuBg5th+XX^< zP(8Q(h*#Db~)k`vmAO@`(7TP@7S0HqFt8mG{zgK$Drfd=ck-=0f#d= zU3SNVtIK1F40Quzt#+=2;jHaNtrs5KlMfgb983=?oz!Fy zN(oplj3y}cF9%YJk-8HcqmY7CSIXxpJDHBI)sZ*`c4x9_{3_WEK)C!AV(Fk9YIm+= zA~k|6vG71IJ%1Vnv4)yBKHo;Q@pA`mC7-_}WrdyJu`}Ow+~`vwoE(}sIf+C#Ok{%Y z>oK%8I<3Sc;>e1!ii#-c)iT5Ob}PC%6~;!`WPdfJl4T#~J1c8TTRY>UU#-ad3M#6Y zSm#X4i86jF?DFH08 zMxa0$sVu7!&<;!a6#3O!Pe(FD>l-C`QDb?1{Jc&9zzWU@MIJU{FF93^puQQ1>?L8a*Yi zozfY2tah0AHQ#xykI1=ms(*O%1GYpiaVB#1*deV7AYfQX&sfrMqjF;r;z_i+YIFNT z%<`Z}87myMwERavn;WbeALX3+6(|WA(N!g^p=ASGM9k(8)l#b(thGk2>$J&i0{KhY zWVbfa;%Lrb18#f@;WppvbM?;h4FIoM%k|KnmAzLRj1zIV^Jna{p8z<#I19doaU*~; z)pI1LbUc?v#SO#2Mar2sj?E`HL1jKmL%xdnk~qlpy31Ve5C;fIMsV`4+U&`?v4U1k zz%(`T`NAbb@MK|kIJdfI;0JhCKEXCl&t75R#NI4G9`VV{TsKF4QFUELb{KbwF>}U@ z4>?6Qp!i!$696QxK?H7Am&y+I>#%F%A(3=-Xy;CGEC+Ww-YBiDvRbO2@>?tFUk{(L z`_=vx6C(kCNR!*F_U{vkv0H96PxxA7l(H?~mEKU{wZl_jHG^zxe*e1yUw^bU-1goj|;u5Qg75L|S}j+igFH(y`0vc^%{w9dS^=&J4ASyE0^v^nt5N#(smQ=%8whz?9i6HX{6)2 zBG9I2D~TXV@le0K?up`!N}U*AaMnNL@`<01nVA}}acSC+jh>n=f5ITF zHEVoV&1c6e!XMiIFZ@qwaCn*4%rcxeT-bRSWjLcuV)SeOVd@4!MYyy?SlDP7C5n%i zo}{8qy@!_)X#!jQOq8BhD7A%n8M^}vJSyL=?_7z+O_^uGg}#9r z48`-886#@;=C2R`IHdJt_Wkf{p!1PBNl{uf2RTRV`JqLV!&~=603Z3O_zA^KWg~zW znr*ub7Ri#T^Q}=?7EX%6yXVe|ZUsJuhLx5j1kV+{Ocs@)TwZ%I`fH?5V3{{YP4Mu) z+I3n~M@>O*<(9e~(KbebSkzT%7wPNhS2BNXYj0kR!UFT%RXLPWA!tmw!0(F5;J8Xk z4mhlV$~;72?c|)aR7(c_HGY>2y*I>??RvhNimS_ghrHn7{TVy3DS4!2mB}^GI$0mD z1F%?7RbqoMB_nrU!6iu(e!FmX7GmaMjZiLvfhf!*=2lv-NL$O@mR~24oCJNTAm&EI zsxwh`;e!ulWhmEt)tXtvm2o)CAF49IVznT<+H)<%ez}xUu&2eYk0w0G-X3VZ2In1oT*G6ZKX5aNv8MZ@Nwr)W7+czCi@uuC=GE-?x zFx9wGh5%*GGWs&J1=rq?0w)zvtB9@x?9YoAFZU}m$@@xiUwbLM2}S=+6*dk}xc6NiJyFcoF(>En6%c9_3$Lw-H z`tfu+m!Hw4Y{_(sk9jVQ=7zIoI+(7uT>d%rH_uDF6VJWg4zU)g|JZ(-;quxWmw1)8 z*~C{43RQ8S>&|7$Ri9b(tYVD6*N4FcZDrHc$<6{Y4BafRfX>$)l~9Yp=%58;B1S)H z?I5f`$zH@-aZ*kCTkXffAFx0;=f0uKEx~Ord0r-Y6|wq2YwM-$eD`rJ79IO?M3%dS@}M#KgRWtA zTi-mHSpx$K{pwUq`}&sYlrYWfaSsM!#m!xcJ=B3KY?Cd>4n^zVbCqAkCWe23S{PlP zNoR-wPWg?FU_$B?;x;qqaz`H3vHyp(vyO_Z>DD|Ek`UY-g1fsX&^R=~-QC?SxNGCk z5Zv88IE@B(2=4Aao%g%nojYsYnYCu7|7v<2`kbn+s&i^Td;gyOA;yoqm#XW(=`^l8 zGzpbuH)7QU(~Dd;?*k>fba68U(O0*FW}25>yxWC?W(J+COSWRa=L;{a?2^zb2cxhg z3r}m56Fz%etBB?br_rrXVLY&%&H);r5iU*w`Tc6y(qcu4OW|`*o_Mp8jtwJAF03~X zc%>qr6=08AbgZt~IimuPGo}tA3g?qhXqNYIFPq2G6shpXPJU51=E4@`7F5g_4YX_y zw+7Yr+&OVH=n{#TN`LIYo!=>*Qs{YaG@9zD(4RJZJmE~6aK}<-=9yux#fh03GM6QB zbe3xQ;Q_XcP`tBrugmtTVfv3Kz-W)7nd}b1VW0|RF!-cKBCk%Sic`h#UAaDR3>lSG z$>LRv_G3)qz~n?hw_|y3VaF7YP^8@P5iZZ@uTq%dS*H&#v}a8t9@wj-Q4QgeuJMr# z@P>#!i2wUR`J>cvB!CXUe1_1>usUY%i77vJ@gP{mjDdXPMxHl!Y_og%Ce z2M*Gg@hh9xsMEM$i;Pg-u0c#eqj!8ZS&(TO-`%Kh!5PMtJiPd#~nDR;+I} zrn;lt=ZYKs^O#mb>D~FSkK@*^=g(kub|dH1MLd~|JC2tT_V^VGm#KUH*X(?|CIZ$5 zqgRp~M1U+_h@TZ@I(juV`Z&j!-!+ftNGe=bl#p9S)eVFr2ffE;@^+uDvGaSg_a7pg z4yLP2b;1K(zJ_zYCWKM^-pNnjQ3R7#GDk99PF9ywpGHZun`Ri#7Z434Q6 zeE!&Jhx8xO*-7NjM-U>LI_bRXfYeEm4tldXd<`HT)cybHG~v%PURqAe#wQ4TM6qil8t zJ`H+q7q|Z*9Nxg#9I;HE;(|~(;U4TNxg6+UZ z|Lmym8A=V99J~e#>>$t)cr3fL_ONl|M|sSOO_~!(u42Lk+~SNX<=`zz9R4{tQwJld zzS<(S!h6mGm5C$%6q;9<)-8C;Eary?FI4oFIym)O* z4kI7!{~6*Yd_;C0ObU`~6Z=fZ>L?~6nOMM{v zl_j`E_xox;M94e$H3~srIq5~oBE9+`xIXS}!^`x?!+|4T;^#j1bH@YAl2!s9_e+!c zTOwNm>tE<1INc)Nh;H6n{$r^WHNpz40rbXHr7f~p#p9irOwkX%d?uM(3GmW;Jn@g`k2Lq~b=>aXGw1iRe#a0d8Zz9+bk2D0_T&Xm0!_ zmtD5@icwY7_KTSIi>M~uC)*->mnDuXIFB%m%}P|`H&{)@!Tj?j#OjJpiy1_CF*`9N z0NQl_Cz1ewLDgBHeow#`6_{G&;|W5?3UmJ;^VW(3H_2xGz17KiGD zGQ>wkJWmjR|Jcw9I1vy`O~S!Or9P?6aX`yxReBCs)y<)Zr^eX$WA@F(%7DEm&l!Hx zkmq4hdILkxPVA4iW)NzJ*@~>|N(!-HUPLTvCOsLQ^p+Y|fV8e}$tuNYq>+91CYkmq z)!{kc%uM0Ibw}riGB(DV%Bwr0IFaCs?`kx3bIY!CHMkp& zklv%S>8g%!kW|?(qvJ9Lc{Q(y4GN=A?2pK*Mc$UKc#Df3Wn&%DoL*46ViI+vC<(IH zaxbM$^@W4|=FTY9S&wj+1^-~)c_WdLyaj@$y0RZ}zF;4O)=|wNrxI^}lI!%oxyF=S9N!{d4j(92Txf& zaViC@F~ct++CdIyXf}+X3nPvWeo#)yD#z1)`kC$fQrDWkxHtpBo*8xBC38YgY;kXU z9ki-k-vc9o_|ftB^N_}Pzz5x=3^0`won{MTo1PzL`?5*-><{Oq3E}QuD=%#TZ^-z7 zLBfDdzo1Ri%84XHn7`JJ4Y(TF^CB?*cbxYD5u1v!zGUvX6q_st$+d3&@Is+gH9Xsf z=!joT83WDUX+9S{$>JCFxJ zlZ~^ZE|4UQq&5_C+z~361^FU#4yR+>F_Bm`2YW&~_2d#J!V@`G205FRGvH%-tSB8t z&Td6C%<8QEq*6Fgn42Rw??XW1ybuUvqC=G?l_^ZRJ5%^QqtBapc)#}ipqR2#I|D{t zHpAf^rp%=yK268b4JEJeyJ6KsPTTv9ZEK@oHG;9*TeE5f)pCdDI?w0f)@w#QU2>p$ z9lcE87@`Qj>k8si*3EO>eMHvTDruSoG%UFdQ46!#Yo$`*ryHVIPPl30%;=?XUFlw` zF`m=x>p09X##*g6*iy6oEPh1H&i>@>JDp@jTO>F~(G8a_*~x14y0X&{oVQWM zTp^?s2A{MdvCz03(8!sFn$GlTT&;={!I^0B2AE%YpBsX?k`m#Z;DSI;?l?nx*l#;) zOS$G^m}DhJ@PMP6dkPrjv1D9pyx(+fcpPihs-+B*>smdphV32xzW}_RaIQBvnn$EA(%H2violt7_AF|o^IUAQfkBu5HVn2JR=;LsrnEVR=|HYJN5Cw7j?Ah z6pIEATPXMJqG2Un=x%T)Cn&6!0R6>At#db&wd||{qfA*&lcjJSL>xoD+VM5doSvZ% zE0tcbR*atY#yNBO79z*n9@UE+0nx4Xh(0CX&KBQ+%8ct-uV;(H^nzIfrtsYF#@}dT zkXbC7`ivwNA(VhD@&MB?u*qgpXN|&ElSSVP~?3{?b0-2GIB=7hv@8* z5{hOJ+wCu_32(DLsjKRM(%P-$8&2DX6)El#SIyL_rKZXYsYW`}_WL~~kY~+;U%xH# ziGeK*{&EPVhbwxNb2C%dtE1-!LHYKn_dzuL;Zqiz&eXufl(7ed9ad^*Y6f2xyx< zt`zHpKI@^E96=n#Xwn34$uJ**OI}gMczPV&%!#%0MUN4j_X8zE27%rAKX3z4?zg^@ zMBwi_Vh271ei2E^)rSGZkWyP+yK^m1#LkCTvC)jy*J|6Tg$rzedwy6@!I znY~Q6KN!)r{yaSyxhg~8dh)M$-pLehkcBun*8Elqc%b^L-2E3g#Gh8ZU(`4?6v(SF zjI>*4_gq5$Ffea=D$4HE!x(8RGADaNP+&TFi~eQV_a5cnh2&eLpH1)f-72lkepMFb z&EHn~9xFsTZ+}qi37+fVW#1?X2lhb5g&vxE?Xu@8-u^vn3J`lcg^g8+QD|*6HO#lAM{c824i*E~H@oRo1*+A>chtL{fPw-^L+4RB4E6w)^KCy7Dl} zV_GWOA9-G19w+ZGl3R?H`g_dAqM(WAQJ71&)-Pe6k3(njrVbPN5wn=VAVf@0m)E*> zS}W}&9NmNh9Z>U5g)yn@{*LuhLxhbE86R6ji_x4qe5YGQ;9r{54{41rV3e<@Mp(V; zYbJZ_)2b!+qCxjzU0(JwFFD-PvqiYhcS3)qBs!Li0aWpw@$s$nglF9qv2_z2K`OQk z>`b2B3xGqqmbb|Xgo)tqRsX@p{+h_fn%YS z%GWkNSHAyfq3&>nfZZWCp93Ixb)A{yCdIR;1@kyNMh5-k6!hNz2S3RVnN3G%=Tx*) zfVj4FR0q`2H4^iM5*JO%TJ){+ev}JccRlR9NNRiIftU(Nk|hnr33%Q8|Kke+f3%I^ z1|`Rm{5}%W%Dz#q%Ls00$eiFK0yFkviHn8bBdD5sTkrk>j6okZ#M;q$u1BesV(CRk zQq0zY&Z95S92QLo|47I_%6{%Nh&4@m3sDK)nu2bYxwzH${%4V}mZah|PAo=j7d&fT zPa0%dz?$18)wb8es?O{eaBYhI9<)DwP>{0po66|ESW6Myb8s=AJ z=r4V^35@msl64KmDl9gM=nN&k9Ccbxa%2c}h1Eb!4t7bQ1Cz5)9BF&UD7*N>S~=X` z-bVTQFIP*L|2g3Q4=j^^&x!v$Bz4Gc=i1|mYeZ&CIsLDuj{F~t2BO=dsVlSkw|+2C zT;|m;4V*IYw<$fTo`tXI3nO*ev>Z^*gSo;&x!%GP*T84f>+5U#^Yg#V3~?_5VQXuK zv=30CGVQX)_&(!bMgEAjlqcVoK|2Cb707+FxJE)*bDVVJ=*EeH9FiFhu=WJ^yF7yhO zE>FxAh%4w!Zji6-7Nc^34YsG5^G);1sqTNzqw!MaKe#uzvGHt%_fIMTuMF^gSobfR z-~7Gr((aYE4gVgM!1lDgpfA+=N$03x$-F*gaUd;TtnhTD(Rbfp^zQ-FnHyQVqp8~t z&A-`GHl)qx%LSgfLNh;#DtphBK@n2S&N8Kfk0NUMLaF*zN$0@Cnk6gbW#3n!mwTu^ z){o-L4LYVZ&s*)Ogb`+Pyu`4A=($bOFFBoVv%tO530DS>4!;yku~0ws#Wyh6y|t|q z9H#+7?o!dH5ARZYN?ds&H^*ldW{US!Z0E0(Wo2bUO5Q=+4m-#+_xL zkaA~BNs{*qA89#R6aDindN z1og#8%$^@kZ=1m0!JJ2(dsV}#^= zY7qVz9;3tF>)XjMZm-YV+f?KBVrHQ*Fp8UP_&JWOQ7dWx;^JIlMkGULS(6@Bbe39+ z-o)P_8wcQb-?$^+^$&(7F9(fPlJKfdDf9I3qWUa1COgzr znbntPPUtG3SS~VyicKt+tEj1=(VvQdM+#kf{+8DH6y!T3C1e<|ru_r7sf8qDWU#)l z|3-NOQ!rzMmvhO+uujiHQ(asQ2W{|`Sy82&6p+Xl?{7n=ELagI?o*R$IndG3@bU5f zenU*~LvUVi-g%+l- zv3hv(1?HF84iojm^GauoTr1%V7b3sBuwO6yc|d83Frd~5Q~>B8IWr}M3-U0cEcC;4H*LdhW&{b zneZFTk6L=IwzK2gm#DWmvkK#bqp5L^C(pM}_NOQ9)IS7XwsL9AA+9U-zFE!4kIG*! zRx!nBBjbY3@4Q!{7)u5Gzy1<}x|;eKCLuI~x@ zes{6-T1TxmBh>Zf{6gGTo18?ht=P{`hO$*_e)S7)1jlO&{!V3cQkO|%UA?A>PF#&I zS)Vx<-*;1D3p;(9DCQl7V0OTbA(OW6?Sn?!eYR9m``JvXYUo+3vgV81Ci|HZ|!XIwn&qjV8 zwwl@+Ho=!Owj&n{4TrwsDYXfo{ZktzEpN%CC`mnHi9L$c0h2Y&{`Tn|Ir5wh;X=NV19j2vb4R{p@m1_pt)W zk{dMJ-noCC%IPyS%|1V%opfvUmzfvq9a=+9f_-nN|CwWq#x5Vwj9~$&xd< z126dTC{)~+jdJ?G$7O_($0KS9D|ywH9q#qK*YXc%7pg+Y7a(02Yk>Hp_ve0S^}xag z(rQ~gACKUl1#MQR@-?Nay>X+_2Z9P5N61r7Plu*4k5r=_uj9!BEZ@HzvfbW~5A{~T zttRwE7}VB;kt>KhTE-3=RjU&MRU=Az#?XjnQ#|g_@|B^CkqG$(<$4YMc%!cCO9P9j z(j*EpdS;p?Nmh;5O(h!{or2%l3e-o?qFMiXe0bYuaWq-aO*`~JtU~6C=#$<8-h;3r#gVdXD zVcLA~K&O72`sI%hrWh#HaX;Y`D@lS3>FzjVt5qDtVBbdB02x)i%^mjMrBxPL&+x|PY;jX zPyf`jIY%``&bB+m9YXg3JLh2?!k6^`6oudMFu$}(u>rvhXe)8e?jUr2pGCq5S z2C2w*b*p&FZ9VfiZR03ZPn{{;&IL+h!#yg2b>@2Iz{o1o3Pq6}>Ff&!AtxEQGWq(% z`sWV??e3@ciSKyoFhA1O-EGE`jsW3nJb!g0vlvGs8x1xyurB=9`YKI2XOEk4HFVA@39b(`#iIe^koLX$LR5n>7WYo6AU%mhG zZ)Qa;sOP-6$8;P)=y9{Cl1u;mU?xHpqwg~{b!<@FrIk!!uuJ~dG)6q3)UG{AYROrmj7a#+nMJDM%)$rp??^3wrS zad+6iG4yVU%ln~gXc=kemEf zI3C0H!phbQ>xL&m@tlF?_8{oeR7> zYj|acDC5vIoD^w0tD?BHL(m=Bv~^tn=-{g=9Gx zah25VI;|j?b$!+I3pNve)1XeyDwVPu1|*L?Lu50p3`5wcGQ*(tHhRie7|asrl+wQt zJQtnY;=`~*0yXsL3gk|5v)fuTs7QnC%~>4T0GjE_8F{Ia!dv**Io!!Lojo?LcN)@o z$>H^$YK8gQd>qmr^l0V%9cFc6d=@(|Q*xdpKDvC=CP)>a@@@!>4#xWVzriz{#Z(*l zY#j|_mrIx;AAkRf;j)}Dym6-4Ag@xcN+9&}Y-OW4e)3&|tQLgSvyJmrr@2iBHW9Pz z04`Yyqi@E3G%?WE`y}_}ZYqG}$1i`dqrDp#QaeORa*=kY2 zyk-~CJ(Mir&+&T&Yw!K_WaK6ExfK{?M!S7zFOmAyL#-NCmeeEA6wh^+iE74Ba2ZHR zVjA*`ecz%04RHfxE9kbE$Vl6ykDPN40gb& zIYF=UHP1kF*$qovOijUM4NGB3vq^$GcNhs_P??9bVz7$y6PQW|&lUpnWPwA%Q(8H$ z?tSx)#mzF`4Jl0cepxeUBhW+_gGGQTveNT9X3OMUvV3C zBST99_LpHNB~hf7kc@uNhd&)0XQ)2+ZvvF+_?B&j%FpFi*q%|bISCSs>aGb~9=_-X ziV#nf&|>s&3s)E|^e|1TOt4~&wW$H^VE<%%6=ARVf$z9eF7)FF>nUkK#I9*W#BHXv z5x)g0-cvHFE1f+q!4tO$xh&LZfD5%&?HPyr4RAk5n~3#g%Z{%;@A=YJCm8YG+$bXZ zHZ_Vx2+^ZXMur>e3f%8m?t0KjC|+h>3(+1uTS6jH6$&jNP&6|#H*tC48CCGw`fdZ9KnTGX>zby5?hDrM3nzhw;rAN%W+mua8Z&(gbYD4G}*(4=XMm_YYBk?UNm z(7oc1L+k7K!Eb;BRQ!0Ne)*%v^+W7cs3v~8miSu=QM(e}o}?03K4DoGGj0HHegc{~ z%SQXbLX(D}zL2_S@WYz+GmgH&!9|~fA#UMuy0(DU&<58Dbp`+QjfOj;LxcpzmZ(MY z+^eiC#|3ZUR2U45;om*hdzHolE=uIlPW3b(pKB~%Pe052tw=YS}R`%@6RJ{ zyI$)?#W+uO1PYpztCL`b!eMBr$M7HcKm_2cwS^Qv87b%Z&+mMb-Mj4`_(E;6bJGcj z*OcEEx{O*D4hi{{(c*Do(Ea~89XA;}G1ZZG>*-x|!2?!qfh81{H)`T;TsviS;UUjE zV6V-ZE53HSBFF>n8EfdK@%HIu6+|@@DMt2LVm??u9h#utP)w~y-%6hXC;+UCFg@HN zdKDi$T8nd4%mL)h0dKoDuQ_?ZE=9TSFm#>(Y%_|!S3 z3H@;3Y0Qc#FWVPaOAN|k_+jpX>UDnqDczSh>iG-QAqDohir3{2HcJRJpp@d`ceeuF z{6Sxx>i=K1_gW+Ck-v~6X+k%&z2+uhVYCb+GJ5k8+$i_8cCtU^PCAIBoWbG3Ff05b z$A=;Yyn{nI&q}4Il+?}ba&!q&2~*Qi#Ac_Hs1Z#&T0vhCLHUJt^w%8qQg>s9FpT!( ze(VB#^Al>SQx@Q~PFGUd3{0vc^D=XRsUJ=B?G}ks`+uXZT3-^u{3_bdVOZ_&o;^N| zFtaQfI!2l?7H8POE!a4dLHjXg1ZiCXB@V6In7Ta499|AuI%^I6SG%MiC+OtAgW^-( zlO+2c34moUY|t~81~ZC^=5dJn3@2PQKJvY%){=LUO8Ft`gyW&Heastyjf$(!!`jhv z04>xV%q!xo$`KLv=V3SEa&cwn+Oy8Aox{eUbtqBJwA=sPDrr?5nj?=7Shso)(=;uw z-sLsDR75Eq;J;uIF>!cUFB7S+UIyR|IG9!9C=u{7S4asJCnIgGXsDJCN?r(?{$g%Z z7Ao#=(f**iiZIr|A|(;BZEdqaadA9H`Jo-B{)pXxc^jC_r0bdf5Q%36N8>e zvVM0;rJ&}d>6!X8&5{q1w!3wiBQ7l~QsTQ`m)EbW?dVJyi9$o;o9SOiB=lqWw5it0 zYyJBX=9lf8py6H8+6K)j!|V${q@TXgd%Sd`lJZji$=~LiV#a`~N8VE8q+~3vqAMF+ z&^LqkwfsZ<;gcqW>eO+WOLuIfiDPGG_|XtK)dT8DWTte%ah*$u zdZohEqPJgI_hzlOz>rGrsL2dxu?)b5d1;Q>BSS2Ib_<_3`1VUtBv$(HZ0YfL9_nvb zsG=fhssuxO$9qJAd65#^;;=kRGnCi>HW(lH!3?`3@k*{Gf_@u(QF6VjMhqR#n1+E! zE@TWJ=DB=p^WW+OI$I8E^c8+^)8G}AkcHp*HE}#wj-O45#IrQadj;RLFnD7jgJlUF zZ7N0A77sA;D98idTk)N-%u->R-ou`xu$3_Tk9-CWM&WoZ8&HB!VVkd?Ip|}0*3Z6I z$<>k5LN=>-pBVCn^<7Cce6>fsP3jo1ZZ;@#^soXp(i_G3${fV`m~={*l`c7EFch=x)NlpD*M zM5I%ONq-{h;H0Hf`?Vg<+VkN=g4UoRiSs(FY5BXniJ8-D`_nYNjiGY=xhi)Q1`PA@ zCndow>0D4Po9H{&iEbQPdU&uO7q=P{d1B<)kg4KOzyN!Er(=Kwx%>w~puzUjJah2q z)>crk!>H7tDU6o?TP~;#H&`qIjq=2N|H#>pn0((Ve95Zb>><>?OUpQG_1m_%ojKqg zXYtg}#@@hCSOEqNE^TPRJWl$kDTkVx0bA;*NpkwgR#24$<8hU^bxYba@2hP17h0aK zDUWVfny8k8N#56^y5D8o9R;Y2`EPzvL`WchHsoD8l$*J3{4$NAE@j1>z9?AterNg? z$B;Zb2U=h>FPJEKtwulfo7PQB1z&!oFy2YUAeNgwbYuVAI-Z)}e{N2tpzggm6?x#E zoO4Pc2iaQ~AJ{iu4F#>LGir3vQc|O)aoR5F`Guv;V-`~-Y3gw-&E^wCjibw^*IcQb z-lZ7?;Q08geLl@vsh}7(e9nw9Yn2kPy8S*W)hxD!sp#5pC%w~&d zku^gx)Gn=flRYOS5lc)OS{f2A*vgH=t*EFZ$QIdWDn@4$tyiYmhDF}zyD2^oJiY}< zc?c|dPU*OT%LW-^QClcZL4L8kt)nO3QY*kdjz#QgL>9VmCj29PSx^lDF-J51iZY8B z#5@VBH$A zOc8=v0gfl3^yXcOJPKH8jGcFvuw$xUz0Y}q&=Zrfm=FyV;-;2MD~d}?<`x8UWkTEi zO&JmPmo;Y>ce`Hc9WSROI6|bI83Xx|a!dLRUEIFwkva51n#1D1bAq>A(qs=FKDbBC zhO5cL?;3^6C<`UgUd=P2+%Md#FDH@pfnB^PE$l4B#A<%@d}%Ik*Tz)FM7-l_BlGyD zru5_{cS+9D>dwhXzq`%2dZeOcqg{$^=5{YtNUZSTY~AqlAuQ1s2Z@6xinx)kpa$@= zYFR_B?mJXIv-`>DP4N=h%~OoowlN?FcsZXL=(AhhU?quF*>aUP=~pmzhRytm86%pV zi9voyU!huvy|yE_yh3Kd@bXUgvS|OVi%jDwABdb@En~vtRwowmTFjakw$O}5lI~A{ zWi9Q!eGaT0c-_bV;aXVVp{9@AZtr2}&xW^2Slou44)GGah)V`oHq>X(3v!G4ioYmd zw!~Oh?$u<|_!0WK*Frdikko$;tWHfEaLVj>t`!DP{a#V99azO4+l&bvM3f$uiw#Y| zh@Z-tDyFqONSNKfhbPD_@7JMPpP*To$bOqPuv~g00+xi*2ZNhNh>#{_F~w&8oAf@#oj42 zrO=W?57`4Hj7%D<=*bqw^tUR!8 zwcsy~d0phCQ#{;`Hu<>yV3)+qt*N@!uNQ};OLZY{A@HsEWwus;BBoHiMQ)x&f3nc@M~J@P<>%x6=} zQte&2%}UrY*n=*N22H9P)+%v``+DDMqyf)9f1x&4UV1d{S%8yPm0;|1(M2dR`;i}s zo(>*@xfi>f>a}70WLAHjMUYC=8q+XC=n2%^mCF&(VRgf=vNDFX`ozwH99F557B<2_ zC7TV=;vMQFeZ!+%h?Ib)h!tF19iynCauJ{LM-UV;Y`_|dWh{Gd&+$S7S2~Vqlnioe9wqn{FFM zadbw>{x7zq_WB*1FcvCBN}J-nZan%%?KNvtaYu7P4Za|JMyJEpaxdOA0#;RMiX?i! zp&J5&b0URQ`;@BDPyx;;24}jIeL6<|O8|3+{H@2;rdS?4x@n=9bPB*xZa8d;V}4ha z^rLS_86|RhAD|^%fFUoTx5+H~$1zLsqJlj4=y1KAB(96jU1^qgig&tu)(tVu( zEzMVvw5Eah`J^tm7qkwG#@J_V#phF^;8*?wF9WJZ5|HYFVwdLYZjDr(fZ?HGJ4^{* z8c*)l$?5~}zafH?i3|C*JvAvI=@_)JyOKONja!h{WzL-=E^KG-*<8I zQWp5%ma%GN)4HBi1xo~T0SX`SNee4-HRjemLqj`l&6Pf=OoxsGF@R1QRpl>6?&X#K zMv6(qc_TX15!lYE7H6VrEzU&xpF#|N^A$gtHMF;e;0UK}-9+9eJGcyUdI>hLXIPto zZsBr_yAX^EXLKvIp@pbCsr(=0b$z$&khypm7#IRY`gE2VC_F7k=Do-(oW?Q+%@}zv z7x8@`x$WU=-RkqHlth@s?8t8IK`}a8TXU zH$e%btnSb!9fgY`X)? ziU=uhD_(RWuE0@M?^9r%+Gh2KZAgGW+e(^R;rJ0ft_4rEwzY9c{bVLs44aqCQb`}G(iQqB%@ShR&@~yG~s}PbRV#gu||NLH|t-To=%>3IZ@-msV#@I0`MV{1H zEkT)9Abuz0Tpc_sxVD0T)uZCF^>g-w!~t|si=Gi4@Tdv(q~VMRJw*y5{j@_(hn&3N zo{Af`fOfqK_i_-DYFGMUp6{R};U0GZO(dU+1(Yu!&szpG>dS-ifa>Wc1+cq8ugZCACCi(6I0)?J4}Fuf2DOS7h~U|ys1h)S|V9;t|kaS!T8 z0e(g@Dh3VB#Uk{B%cm)@F5;SuLn;Pv+&RufZWKB*Xvs7Lyk2S)xeDW-2wf16P9&p}&9 z(0r-{hb7O0XMqQk`Z%2NLe$p5Y!V6W)dH55Sowu{w64vVj4&)T5+|q3vhSO=>#|Wp zdu88IXTBonr)x&f>{WGIOQ(|3lP@+dluaaw?F@Vl8^UXTYm29(%#eL45{QskW2*;C z&e~83Eagb>S^IY^VCwdu`!jP8TQ1F@Zc6d3ZG*CQet238=6Ga4JsT9SMIbg8`z}y< z*vjUp2~p|Rx@D{*^gHS>A==h{Q4Q&Os$}ueJVk`zqi;3)vs;x0-`ynTe^wca7qnd1 ztXt8q7hezlEhqGvc^A^+J!1Dud4%jy3nc!8G>Xi zkM|G^{Bw9!&3UA3QB}AwuTqF0*~goCaE_HC+4V}x?@j6TW>@fK&T!9a|5v)UWrzYe z36Js%S5tL`1#MI~!!R@-R7|sEV0t3w;yNMf;i9J{|0-PNHDdjBp>^sH=Onw(Sy*oz zHyX?ve;5)J^7pG400nv}rDF2>l4<4R1Mo==;nd;&-bttcuZtmnZFJPNN2P6Rb#<$w zn@gwLTy-_ENzV;{@5rvvw4brHR4G}?RGvOQ#|`~GGRjALvQ%!?xT|y+8dNmNIQp7E zwAaq>N`7A{WA8~XAyiqnqrHp0{wos}`ulFpeety~U&1cJw)Glw?fW{>NK9wwy6Spt z6sA~E>uY<8kpR4>`L3%aszYS9VnX-)O7030Wp{?rz$^~-8z)LJZL~XZmoyr@sKXa| zI-2`W3~?4+XFU3tC^5(>yQ=I_SBY8KI}aenOxRVnomoN^OOBuLi?k7MFx zX4!7qYG8%W_U_q{xa zgZxGz=y(`*utTFJf$s8D_c%^&aInG66*$0*7;P!E1T>*m2v%T|Ql@FFHbO8^ z?ZD5UwZP3iB;7YzNm?KDyEh+X2s6@FCxny?X7rsM$Gl!dcX>Ki+3&_viM*t=*0yG@ zA&G5`LI#QxE=rVQMf_FNhit|1n@t^4ZyP-M@krRy(Or^8Z}1%pW=r;k$yFBy@(IHD z#~kp!C5AuU4B|AirTAnM7kHSx-AD4UFIP5SVLTSIygE=|)HLUk{KG{~A*~@2+sTw& zS1(vsQC-tyhptEw*6~ucU3$kw|rYc`n;78e(O(@?QIxCubBm%bteKwfc;Cildt?4NYynPT*Ejn; zHC(fl@K?50D<7#eh3eI@OdIj`L>gb@C*gZvJ`EYt$L}PK_0{kW@`$Q^M41GkMTLIU zyS{g}Pqf2-e&h31W`f4Sq^tNkg*+0rqe>_VD$iqtfhsI`Qc{A18e$j0p?3KTmIe;+ zmqGFN19^{8JWIB6?u<3c)~mF+g?^HiVi0{@sUXsB*ce%2we{f$jrnNpNQEu7al##` z{N<_k%%l3&qwB|c=i-}8Ui2uqV-<6UjlR$EgQDCmrDFyxC9D%?Ew!!LW5U%+4nb6f zJf0n!Q{d1ecq86K2h&_7(G^TT#ug5`DLeg?OYyK?-jI(AK|aJ%a;lMR{QL)+A4Q2o$zgjbxPR6(n8f>v=GPR?}e zrFVPc@`L(#J}Hw5ZYkXlz^R-MEQdgjo8@_6Bw;JQI~>+MdJot6#00H9is%Z}PnOdZ z1mI8qn6e2i?AG0|Uz~aCL ze|E2Q*Md`akIEOe0xNRz;nRw|(A;khhH21XN*vK=iaTOI9`A=0i#UmXA~#|-DTwEv z#Ebt-XnnW_jdd4jFUpeI0~UT#dAjLDlWDxu4!7D(SrTXKpP4vjygyxqr*fch+|^V? zs?RT>?*PVlI3G3ULY%&>u{iAq5$V(*1hMZ!Ng<`QMe;#ZWV(XcxDmORQm!#f4yHzx z1+h{_@{N^#%9hhh_yr2ZY_adyM1|9XNp>q?YfOY)_D|X=cnCZ_Ls~p%6?CbJ+E-Pm zPipStfF+q7ygpkK0P^bX1<2tb482_c>s63d!@4g$3hM@&z>P z7)PSk0q*4G#XEDy05E2}E~p1p#99^Jv22 zKRT+cjXE+Qfx`=wDK&@n25{doSZ$GmXY%NXe-6S)@mwdD_G0wZXi`-O19R$mufNTT zE`Aax2Q~VQNa2^+G@kTX(>FF`Omnz4;tlV^@Bq_gjXWboCwU87;|QFUP2?QgZL(bH z`mqcW3RgC%iCfI0ASOm7NetM8x)L?u9(j1$ld4i@e<~F8Ewq2@VN$r430{S3dY6~*cAGe1&pog=aOZU zX)m@vYMd_Gpkc!oBAz(Fms$ZEd9Z!XbF?%BGyCSaKKn1rjwD668^PhXwAl;~qjNYY zq{|h=Lo$lk<8z_5J<`oNc`Qm6=0>>w<|3Y1wUZrnT~;i`X5|y4zGPd=(bBt84iBP` zXT``c_iD15Sn47MXOH_*S2w?2AOGBxhuOWL@a_8DBw)u1j(Utf z%y&NA`rgY4CcHi$oM@#vgC~^BgAx!wIPBQSwR?3RukNuYfZ4xk` zhvM!UEGNA8`_3I_j63f6aeka%J0mN5&9$@lp7P8&pQWv+clsyBJoaI#-{JEnl4Cb9 zfm&J4b%1LWb6>wrSoPMD+ii*F8&alBE3G8yy>rJd$P0x4O5tW}8O1_113>Y}bODHP z@vZT>cNZ_@bm)gG&m#F_uNG=ly;K#uFLE%43j-P*#@qc z0xl|gpSbi{eX9AZTkg#+J-3}&$qjD9;u>7rx4p8@xTPy=$qkK_dH+fq18#{1`$gD7 zCP(epJ2U7aM3}h9LV8VVk4+FOT@ud&eIKw6Cv&-FC{#%|i6T#^zluuXk{8=C&sfgiD zKV)mkYvr~aol>{NC^aLwJY3%QJ-SUJLIgI*WH>W35TUA_iuGKd3O;G@%kqBJyXsRj z6p=+@dr~=5Ih_;H7|7QB9#`8ihPtCnch?Zz9$fk6Ck)p~m?6c}X1jRWc~ZhW&}7UN z640?CtENFb)uA$t=C9QI<*`TW7TMPkoZ;I?#fR;lg} zHV^o{VA;8dcI`DyKu};PLlA?D#@SB!Rn&_;nYFrVom}0g)Sff$voKAH*wFBw(B;IS zBYD-y&kOb&ifiq|Tlq)g9qg$*dX_?6pidkUVrMUvdLOviHSPzS^=+cCri}Nkl__U% z25dUXO8&oHlGx?M=B#ys&9?G?SHtHu>jXN~j`~xWAb8+^}>xYFp zzx`oWucAk{?)pbo%T==?M~{yqK|n7h&4P$Jr?5%cl)umR7>jnx)=y+!YruW#b%USx zkS+!og?35bQX}}xw9D+Y)_JtE;wUa>rA{!CMg8^AhBb$TQu5J4HHAZ;wsIo-<+B~? z>6IhV@=x#pV_2MG?RNL$dtFhoz54ZohQB2Ea8fx6bc=-(g0bS%6$qo$X}a$aory7= zRG~iU!*iR!n`NV`*uZ@+N+-Z}U=1XLs~k`~?cs-WroN#@HG7k&4J5hXfu{-&6{WP4ZM zyagX&d^tsL|HSNRx~~_{Yge&=vO5k%Du#}%t!9!qHstUtkr}tZ9aMAY7-DukY8=p5 z7#9UROKgDu<=_y*?bxX~Ja8DHyiQdSzjeG$GQEFi5VwfW*&Jd<-X5%N zYfmy-m=&y#4GvvU%Im6T*usI&lF907@IeCke`5i&Bh%AcKg$&g;&px zwO7o2{0RyNdMOtW{Kso4<O>-? zE^ODk^l=CnqbQIb);*Qd{@!J~$!_)yr-zts|Adb)swXDDHZypTC1gb6{74JlG2-@H zu`iMYY%Wu|_s4@Ea7fr>Nsi8&EQV{k9++T|yBJhrnm4OR5P}m;F;1^tp$u{k0AT=OdHRZ3+|QB6&$7KUHM&ep>$xcpa_+oe{)krft)*EE6c zL=ILlPW(=SkfloS;$HA$(+@+7;uZfVqC+la=JXZEAcjTBp-lgA0qWLO3GHD)DV9{%1CpeG5R z&d~2u12_;ZVV0NmfIB^@KG0dmE6!ZZE2Y4Ni9X$GHjY0x6-3-#kP|_XG6hdFlOjke z(R*(Z$KxOG0loz0!R?gcy^Yav;MiN1Pc`3>-wyrk;#RA8ReRDLs@E}v#gLc(%F$+3 z6%Eu>UMkq`{!9q3&-BK>-ia{C3L0oLkN& zwlFJyBCu?|w-i5x+zND?&Tx^$cYx+^B^zbOs$+%>kzu&1j<0Gv&osJPI$yiG+AXiv zd~3$!!{6U=hSRzeBH`ge>gc%mdl7zQR0tPh+Lg0ADE*ii@*H!3!}H4FVh}Pi1BmGO zC_Xf5sg)~rFNQ0lg=Kz&n&7ReWo4OT^-Ya$MXm89rIXKbS(s#{lwv6RUQ?;;ibBTK z3!a2r*Gypw&<2fN%`GX@<6m5&9>CBrf}xOOAREM&Y2ss5l6nQkqAc1Y=Vlw+39g!7 z_l0|=isDv@1A)8#J!%naeP7=FP%e&eyc=j|E0S-GCnrq+ z+jnrJjpz7or>htB6sdL5X6doYeLrN0-L@>|rkpy`B?5dj#9sM6xQCnOwf#t24%1~fhc{nd`k@#$xoeGUyEntD$Q80=$T<# zbhHhhW-yxa6Hjg)zn|(Hl=Z*)Wi(TjKSPCxrj#CqOxYK8ES?U&nt@0p!Io5 z!NDPVm0a#+@prn*6V>h%y4pR>rFEntu(0jDaH+uBO1Sgjt1$b7`ih-P(5o6&2B-No|>O5oDE!26$i0x7KXNo(ifjw3pLAtMBx(dg?JGqG; z8jel@^%A`>&MbM)##?=iZSw=&xc-_|@471(Z!n_&AqyCO$oyZ8#J}x{3bRO9n~`QA z^d{i-Gv?;#*GQbeU1@+rHpyeW4U~>Wj*pL59lH_%{+d*{xhjFdJCejV9|6+x0&i!- zL}C_g%sf$*=!omHx3;!;BSQbn$sPHixDM$XfV2m&0RgOu5zg}AH^5(MTIPqeJ)z9z znNw%KDvMoq2W9Z{{~|_v)Qk^ZU{^A?B%fW&NV|0>8}{KTvC#VMm%3ZUVBmR^*en77 zh#YCl^z+;*7MA(ojqi!TuU3kL?px&F96R`j_7&U={Y4Y*xD7{00C4cWI+4V}W^uf@ zuv>SeZ!-d3-}_1=E%(Djz;oRss5$FM{*df888tN_ThE+&iAMcRNYjSYO}9Z;MjxL!EgSQ0ni_ zB_tss!Ot(TXEGnw2ZYr>yIyI)0kInoSzVjbiu0+zZ)i{4bM^a*Y4J_@M zR7Ys2sb+-r^z@w}S+E4by^~_@GwOOY^mJgYj89V%fwwd*T^vt8=#6Fk@D6#g^kkzj zF6`~Tvr9!*MlehUWgoq{+{X*?{Cpbbay-Zo2!?jX{+wD|U7eB@;lsEYoX8u)oCXFl z%$&v>M^~(-78gUwV5O@}M6oEBdy z86d4F4%AB$)N<1Y-Da(%Y^q3@0lLdepog{v%B_ET-8WVzA?xcYo+2jw^Zn|keqygx zc37NYTTN_Lucc;wWq35drl-ZCEkC*d80cUw(_6=mMW=Oyyo1JFD!cG6qldg3LI%Q z2?$o!U8x(MG*jx6bbqR>s4J%^msy&a{B(9Eoh3_toJvVa6y&O|Ywfc3$9n`6o1{(C zfb8U7Zq2BwY7*KD%a{LDy7X{9YTM`PoA`SwpG%;t>7uW*mu`rJ)UL-T3FR5H$@O7R zyTs9Wv#&k!SN3I-!yP|&4?RE+!<5j|G|Y&4X3=%pBdRR+gbc$b3E(4uN_*iZrkgE6 z%~>rDzfo@uQCY{I@G^LhvE`hNuuC1xAzR5~c-0N-Z_cCUW@)B`MW9$C?4)u(iUyKn|)$T>u zMsx>sH{^N3Z64~AbIPvIfpx<+OP8c(QhQP$GNFKjIAf5q6EeMcvp81XwL756F2>Eh zTx_yJkFiFPz>7bTr0+Jr0vc4Bqta5+WX_hKWDvEV%Nq5$n&o|J3b(V(0Dbm)in50N z`+1{Ror^|GHR?s^n9d;g;nf=km0HPZpg*hYRDD9#RHWp6LQbD?&LI*z8xFhvp+{2; z;5F%tuELE;9`|(D^!=ZO;5aHuMao|nk^Ft=QK>99q1F3)l^>Zqt+$}N)kna1b$J;i zRchdeex>xV4#GH@du#|mn@WdhM1eDNtL^sQpr=urV(^%!tdT864`!AHNWrS_7d)V8?Or=Ra$?8o$9j13;YB!OPp?2I5GY6@k^Ur(|L^3Sl|MpvKm3fdb+ zb)$#gCj#k{SBUDKE~bi;XhNr7*(tT(b}|>I@Chh?RpU@@QJ~w6PQW|w!J7G&pgbyp zp9d^^HHkq+WzyCohpqukOR&AV!mLPct8`~G(HBBm=-^II*IhYC7Q?YSUxL{Fvz?d# zFu7_JX^EMSa&c~p-pKv%9s@aqxpDAKauA5t^(zmRyC_AFiFrp-zpSbdYJgp4#Uslj zikvwD3H)5hS5E;@87@@rWe0sD7?l^;!(a>BK>cKwTrCn>f3sa&GZp*b`)1W`$!Rla zNSwIbP>y;f^ud6bRz-X$H}E^RDp4i8$tw%JAuh~E^P;UOk@)|H0hz4tn8(0hjveX$y_q%*Z~L7=fDJN@2lD)s#akR^DV+taP}@t_wWnD*gfe5|3h=!`t~K2gOH)YTS5@F6iY>ZCSzgwVgY0C{ zcA}e&AkU@hL3X((o#Q5cuApeK;(-FV(c2;tt5hjRACblnMIfgiu480;A8;nRlj~J$1}F*zHKa_b zkjHHO8Je_2zhT?}F`_%|q5+d2O1987w#PWkg?||%bYN7_6L^tKtEpMmrI=OJE~I_b zXJBMQ%$gF$64sX+OO*dHQUU^Q!_)*Go`Q^Cf!CKOwzPlrCspLs8(heqpUyNPbU8rZ z&CmFYF$hqOl%ajKWrebY7Vy_GUhZMWh_wv~M8i6MKjxQ(6XxFD?WlvdUvziBzcA+$ zNnt*(O%X6E+HYZ{*IhyP@<;aDU>!Ljg)&eB1*q3ca?~Ar%G6|5VN!vpw@rU4mkk0h& zcayog()^BxsfD6`KEB*ZC|Tqx^wBdBdup(F+Viz0s?u{8VA-=1B>uE`y zanylg1+hE(?OMRsXTg5fO2M7(#|3@cMx%V=2!7jTMx>!#-tEZvpUo+UqOGzQSLodh)buhwIWckvvOMq-`>Wscx&Pa!Ww- zp(m3kB9m_)3&l43OWGqJ5}j^I=-V3>-){7__=IPpH2rN%`po;7?o>vFED;t-XO1OJ zsjRKQ_Fo`VGTUVmYh=N<#1fZWd7M~lHz1mL>~??7i;4e3n$pcQf#89Uuxp3&htS`Z z)awubL(j9l(gGs%<`Ne)) zyLmt{{coS}Wk=@KZ^d_sdL{gvP}O|tP!d37o_efw8QFu9=>|7k18(Q)hKu`MIe-IK zy~k_OZ*c`_mus1q$N}{nu_`fs2KHe+W-!Y$`ip8m+71G!DoADt^5K|B=P%LKu3VgND zV2m750|453%#c@y2uX?4!)y6cB-D{4+tMgOi3}tsG!{RN9Vc|XsQT#d(6zXGA~vr@ zTg24Z8b7}L*v<_|yZsnK;!?wMJ$dx+5Ln>5?&~n`zjgE3&L{DGTC+D&Q`O77OA0jK z0|2E|{{jXVM>Kl(!*IuaIMcI1UO&E%A0#dhdJL~B`WSPU>rYpa9qL+&DOR*?>CPLx)M?uwpKp(9ZsY+J*}V)VI5!`bVcEP~irkjxW`b zi__LkO?4RaveGA7T}iEXC1-2ujY7XD&QAGp9lMNN_z+qOf>j6x}3~wxb?WKM*jg5o)7ru*m9)XB-iK&XP=#& zBnW!IPYxO&gD{P}+$Ab<;|0uUxB{SE+ z`+xiX{m-IsPP{OZ9rTIs?gHtRnU|cLkB`I=Dy(e*$p&90g?uZP*Tj)^ zyfojNEq;E$wr?Y9x8ZB$e~ zPP-#FNl9`apCf3Ti%w&TQMzcrozklz`gU;Bk{@-B!B?kI2BJ%rc6bpa^}IAUTJgXU zO|zHeslQa#>q?O}+<_mCDI%l>d+BzPxfx%LpOJ8iGV;##j0_j2ZGH!FV7m{9F$5mf z*(0RilqA-@rxF;rd0#H@K3;{9WT9ckcCHDcf6UBs#l&ilGw&4NMl`)W4u)N0Q4V+U z{CWs)8!vIX>Tv@;?Pvcv_zy4D|4o4WfAA~^&;C~APTly*2uI#%P<~$d>5y*sztCCL0aIk(gJGAC9Jqt+cr1auPiJ!5>swz4~l-S_~G2n}R`k={4 zhTCMfXGBWu?ToNLiEN4UQ>+9UPut-BJcwVe_9i^K*#<8ZV5NRPGE7hxdL&6bpNfHJ<*GbSs)nZb$HQ8ccDS$6b!n=6k`yI&^1a zpPkhBmoy(D4nQ#lpzEioUf;?Kf=gBL0agl8Dw)dY_NCY?FS}YVZ=8On{boo?gfTL& z*)1sO)kj3uheR-acx>yUeYBC~Xi(A*p(?I8JY3TA-u6u^_^isazX}QpSO~@=Mt>)B z_=L~XCJsAS6a5b{I$m7!Y{A5XSlIhfF^Mgb!ibUB0BOE?dY$mZE*c`Wp+*ft;lyG0 z_Odjd+|gUc_p?mkNjXBEy;YT?sfV1eQooeouoH=F%(d zm3n|=ic%e>EADjfC9Sw$SV(lP^P(`}SO4I}m@evlhQ6uA>YitclBXaP+@fVpfyr)O z&L~EmGos_;m2;RecB3I8s|_+0jkhw|Ri`QR(=Zb0w#l8>B% zJ-7ZGmFS6wzD6?8bA|WABkvGPj6#&HI-M`A`129Lxpa}y&MCR$XI0gD5klNDKqE(A z;Hmd?iRUDb7U+rY*Qrw%-SYBK`HwcQV#fxhF=^<4XrZ zaVt61WvUyR8IpG|aEDAS-VM*AA)=8eWK5C}H(= z`sX>5Q7}f2u(O5)uC1J@G1nN%!*fr`aqFXL?Zbku9+P+6uMA#miCp9zRka>ow727n zo>n(@k45+mi|phTjH^o2p02sffRT+?H~bU~w6v zMLE0y_H!PZ)#@npn92wIn5@;%I6ITQY`&m8s6)+&xmUrQj7`M#vx!Tx3`&7Z^mL)D z%n?0C*-OrfwzFsrxC8|#172qR@jWFPDF@Ds54)pbpoIqhM7=FLmgR1s>GZ0KMWzo& z6iWb&%^ZywwTDsSwE9Jy=M{P~);7JUKQ((%^Esr>ac0U!R!19u9)LHtcbH5_7fJYJ4;m}!L8q^QoFonM&CyC1-VhM3x{;d-w3G%}a7dz{Y_*4T6xPB@@q9HL?!MIt9l@hnA|`Ij{+YPSdIAcea^PFzp32vW#BrF&Yo^FP@r< z4&|)eIykt&m-t@3Rm#8O`70N?`?ULg=W)~`43wnjh#@M(@56LaYONGnS8mEMav>Jr zBc64Aiem3ZRf~@A@9*KpbcNV#Zc|=nU0@y%@KD7a@*H4Hs_vkpBRkhteTzBoge|rcHbdZ2BNYC7-id*0|(NcQwTNBMeC_f6l$CpFz;UxL@MIz0qvB!2%RP(KsZR4OuK z5Bs3_qCyi^5WP$^+$E2V_S@eW>F=DlXgA8vVbehA=i>MKu4&Y*cpocdY5a~U)sS_h z{I%s$#HrFp<(Gn@l~7)#`Gp(hxsGDI*u*d!WFX6IqIlTT)FjfF%HEa><3}0!_7!;? zttM_(2VGZKC^17Ku`-t|0lEjSrCLb}<;Pp9kz8?%1u0RhcP^r)10?Fq310LN6iI^K zH;C1q+D?k!&z4>jPzaXluo#g6CX{l94sa%nSVYvn=n=~xdrY;T!7G`9xy!Oql{cu! zQDacvA%{6I_!<#WWMV;F7*n3rjro38k3H2*GqOsGHHnOndi^klrnC}uXk=2uHx9(# zrQmtjDBMB)|9gd|tXjLGi4dsm5sOJn_3Xid`oIt%5=x^py+3n?~j>?W4~PUc|Kx zAKrf!Bh_W`OnJHyzC*mJofK4e7Mz}H?q6|h#Kv5(&L1v>(d3H&@)v?tk91$f^eFOj z@5y5iG1<06QU=+A;a1jOB`F2%@B^qPRq?20Wo}if)}(7)@5WLoye>C+OOVBbiMOW0 zq_B768MNikW5}#lsG=DWu_xdCHVdc`Ym2Rq0Yj?1q6^nMHJt(s13m$BN)alql@q?$ z{?^oh9np{C$E*C#_DwWaU6hS4qJG29s?D! zYfJK5b}U=Z#5dqM!ww436~l9&!R4VStx1RvW%m^Gnpe-RNayh6tZ|N;PH}A7W0|jA zx7v@@7Uw;nT{h)U)xE{zX8IL-MZ;qF6fTHx`;}ZEFtd?rRq>DE5K;8gR0AFGvV251 z204*P8zmG>!<%;~WUB!t&Mz`yDIUqj^=9}Maz~1qT6wq|9nQF8XIl;#5iUYMIaQ50 z20cB}e3PZD8OU3<#-#_59P9c=nrv%BO0q9N!*dXg?&a_C^}X5>(|B{g!$|uj`diNJ zVomvwCtl3Fu}Lc|5jxcxL@>d#t%9-pWD}mZ(n;>z%-N}|02Lm#BGeSb4&pl#j2+8) zr(5lu44v>2W8gTE|$#-UZy#1pq0Pz{)EcRZzrS-7OmSM#CX3#%w7PF}q z8aXt+Ix@J*iBeR9diF&r>}>C@k}rGpYC-%g(a&Ei|W;G3bj|=W#olpryhq7IL|Vs()?EM2AhxLg z8SR!bF@#ut=8!xDtpxG6WLokVBV9QVbV7&Onmfhna0itmu0JD=41iNtxLS zma_C<^3*mKyX>her>x$TAY#2$a-N~<&Fpu>{&`{(AEwh|1s1l%CdY<+Wqq^TgBks6 zf}Y!*(Q{QCxjeXv&JFTr{F%WAF*r6$rS@O@Tu@m&?Uo;vKw1+v^vdy9XOYU(BQ&sj z$E>zMdYwnS`te=0Sz;p1`e{nxWS;G!Lx(l(s-^ZmHEEn0naVxO83V?|Y`@VXl<>Q^!(BOT*0IfL3{Sko4LOtPm8k$?vW`JvZT zqr}Zh9A8A>se#vQAYP*%qrOwLPwa-SweyU|6M27++f?AuD3PWZvdk#A8d|#u%V!3K z-1OdQgm2se+rvM{yF~a&0LRy$_Vcgg<1~AnEMrTcpg-Eoa0#)~j0DalHUIIoeP~U5 z{C!gJAh7hLSW$loVyP5$yDM=jzMMZUP8~AY_{IsVN###?e{R1r+Yy+!x#fOt1&NqZ zc!w|3V+R0UC(XqSH2M3kJ9}9&{eY^(Uc9?`N%zTj@zJ*KMQ3_{Zsau=^%p7xpMd)o zMVxNO({(YiIw217?&thoK3R|_c-V2-a+6zPMQlm#CS`h31}T%USH!g<2IPI7m)*V6 zdP}5o&)NE)%8370$%Dh)J@+ZAN>zlmkB<)*#iSoq#dRDz{_i-pySLlf*%d!*Za&)G zeRwtW1Nv9sb$h*oz_rUvGAG=CJ?cr_QALc^;=}b)zsrqF#M>85mJZQAa~9X3DNS>6 zlq4tFegn=87cC0C+HE-VN>*CNhsIly;~e(a!Syd*nuyqeRSx|B@w3)#r;fW;=dn!2 zic<~E5eiS4-Qe))ujF~3AIJB39M&AS`y83ptQj!$_wIS~qrcUHHvp0I%O|s!_z>IK z)pgva)Q>FUj}brr5PoH)k`gBAf7Sm9_Gc(b2>w+N*p&3YUmCDak4I5(I3xJXF5?6)HTuql2MT^k@^_$AI}-$HUIzs literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/08-bitlocker.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/08-bitlocker.png new file mode 100644 index 0000000000000000000000000000000000000000..571e2b0e1e5422671c036d39d42e3a0f29103c4f GIT binary patch literal 77683 zcmdqIRa6{b^e&i$;0_7yPH=Zfa6)hb!GkvLZXGNTT!TZ<;O-jSAvldg1C2Hg4Gr{= z-(CNCxzBfI);!f-RqLGE`)sLwzVFlzbyWpy3^I%tFJ53PDavZTc!9+K;>9a_v{%n} z3fo+8UcA72p(Oi3+dJ!c4c%YMvQ79&h?&_gsX--aM$qBlBXOIie$y-c*OvIsmajdu zJMt%ibLmGVe2!8I+2sXZgD%i$QQg(S-QHh)bo<}tUSfn1?SCX*E-rFd{#$61S*WDy z>UsfGo0;KYQ05r+IR?g13-N#I`z*?Tnq>A}6$ldioJsm**I0O9OyVQt_Z5deFQ!g)$< z;uihbn}-8 z&!g*)%Y{`aFqx%`6SIqP(YZ{7=A$DnuIFnI<>DI4{jHa3F!*EC?&19ar9NS}+qI`7 z!FEl;f?K+z0jM+hQ7iE8fs9t`3#{5JC5ag{Cir;*rLCmHfzcYUHBMx&90aW|=2h5?i_Z(?jhWY$}RN#%W( zzR?wY_v3@wd`5RlJwhC|Do*+YSe2h@E&}QoSTI8rIDKGFCe&5#z%RhK4>dxcAwNdgiW~Ejdwt}Tr`KdVVuA}dwGB`z{;<1|vy#Sap z3QKH#S5|j+3dc|r)>f|T8=&v9iZ5s{tAk})(eHMI{#%1+X~n)oC;i%+X>4*TqxS8E zjvZlEzg9v8jy5N~@7u1`{<6-WCM($%CBGAQG02Oa7va~z^b#Hh`%azUkci=E;>3Cj z?De@J!PPFG-D{!#@U!V%bLFqsk&OmR1M99Eb;u&7W>AY%TAZ?b4f!I;NYrlDP^+R)YR1 z<&;`P^e2^=olDE}%hl}o!D2!I`TjVQ%RxlI)m%(zLJ%}ZDUUa>r&#Fev@?8dYYw*I zI}m4hIf@84f1m^<N-M+*Gl-6_>&;ub@cz6RR0XKJr#bh({^=N_ zzhdVi%H`nsoB(|;Ay#V*G;+&Et#(sYaa~;H0(39EW)en(_n)dRk`%ff`8AU=V#bm# zjwL!De@>e$c}%=DLD)^To1CnC1`&#j0UXhAjfkWxGQ13)*j;o%RT3th?MEgX3m!lE zq(hi}Mj#hqW&mLO^q_H;{aPbnYjzdE6H(HO>d{{?(&Zx7;zTB!dR6C33Z&gl?dBhZ^!5;e@yW8UTayh1zO;nfE{8-#% zdl$_wT?NGuIYk3cm@{xGF{?o@^2OZ7=iMUv$LJnsDpb>Y0GF`acODYa1TkJ^rI7*Z z?SCPWv1u=lcM0=dycApdU@nZ-hai7f&n))^qa2C4qsp$SEVu8&3Cc?xRtD+c#o=)> zQR40A%(uegedEDM)`?<4wYP)C7sXvG^hnPc1qN&A6yhCB@}pY~4FQG}M(gN7O750J znV&|F886omhbsu^k(g@3%CrG6qxq^p1zquHr+;9ZpkmCv2w(gn$e{W5%W!u6 zCljDaDF94o{6+rBHRV8ix~pDrt0KBpXuL7tbF>Ue)qA4;%Ev&zs2}Cy`a({|I*2^2 z&ZKr~qVm0}k@%+E2k4RGdPOUy4rdMUE?~`TX3KShv}Ig}KR8!kfsnX2$1u>~xvEx8&#&0I_b1bJq<#=Ym&aN{@C+ zEq|4PzTk{Ddd+2FY@AWoZ13kHM445?z?D``33T(WqcNS|I=%H2YuPTz#Nd5hdECKb zv2YD)v5!){zV{M!{NnHV3c<(7csibLK1-IKSBf!7^~Es`n^G}Vr?Hkk-+~U1y!v#? z7qn*O`1P9>o%4-e3ny{-CQW@zluRA$Ti!C>1=GUe$%z1SMoE#|>(MzM5E}F3^6l{w zH7P>T_NL=*)VnFJJ}UbgS3IjkUXI3ZzP1&nBCR8qWSaM{^lB_RoGjPP`ty(vGcw#g z`IWHdoeF$}1tONj=)2-i8}yi_9f0ZeNH6{f46Pe=9>JfocG9vQl6U>v^Ez+fS^$9p zs-kV=q7vBhVWcZ1)QbOewoR-7UL}ET!>|&$z%ChK*IQ4|+)6>B!myE1KR@QAP5d%5 zY3qp*bB9jv>0L{Jl`*xHvZv0*sUJ>p^TTHBJJa}&Zz+H9-;eoee;WfQ4VyNox%a7V z2Gk#wPueaOrWP5PgQqYET-!T`KH2XuABy-i#KdrO0Mu;rF*y^tzD6(CHy+QRxp-I1 ztY0{Ikdspw9IDD0=Mu(@HNj_+06aXbVE>gF&8XsFF-b8VzZ?I4Pj{+Z=rERwl5=r9 zPr2)XqKLwKQJ=!{CYcJM1X==ps`p@RQq{CDWD#$}RA!~UtD7!8h^!2DS!c0)_?|4r zc4}3ETz;1f^Qh|nGWAHTNi9?23Aivrb#rrslMg2vDV{ZjSF#sd`&aa3sBUuYkobD@ zv99?xpO}Df6tAT5h?F=8Ha@df1)2JYZX=Q}W6JZcu07UaHdL6M|J&ihHLL}&shnc! zpH#fE7x3>BB+2s=T1>By8A~Hw_UQ{Rm${Gp=}lq+DV6cJPbA!KTN82E0foAkOX4B3 z>r!XlM1ATwziGY=Q7!;oTwZg1i*tfIdPVdqgQU=G>${fj54F^{}hlNc&2~ozGU+zl*@UTcN*J`7iVm%!%<+<>}<{P{4!=%{vS7lENN;hPu(L%}m7YKePJ_ogyAYA^R(BjjbRCjbJv%r#z-Z zHc#e{f{s{fF|)SNU@=&rt(`ul7k11-(Y-LoFF@+j(j>Tk>2Il}q9^9)Hh4oQFt}1+ z!Qwp7r?#;^8T*c$glACRi-TiMcw_sIa;ea^xpag@Lc&MV8FC3V(tXD`O}edzA(Mc0 z*nKLUr7Tgl}Dj`F~t%cqDZj~HL?oBMu?AL)N$olm3rCEleaX%+4 z0s71Npb!1VZRn}7e1bM^iW9Bm@xnTDWt_1*2N`OOL)Dn*1cb}@%xdA48&(zX zo}hjw5e61EXsK)%g9+G~U38(mJaLCEpE!NLQar+%OhoZKox@)8_LerPoHgY{6;N9$ zzR)!%Cz~`Ag~w3>rb9(y^ke7+Ihl4W?uIRTEghCNdnpB(g%rORd}+cBXCpe7aG^MH z-*#X|y$RwvyEqFwI?TdO7Jh;@%;7G1zg{Rbr#CGBP;Bj#W8QHUMmI%jMpEhc zhPaFHh3XinNiA-rspr-kg~K@<*pi{Y->%q=uEdCzRs7IDQu1$Hq;LYXKe1dtH9s{l z!S9OlSOQPjOe!d|R&*{wN7M`Z*D7FtJ6TU{t=ZT;W*Sg1CwjL zkc}-r-hQ%JsL8=MB)i9ZUkL8vESPX&#lAdhw4ojQoKJPPM?Zt4R${xF9j?TeFCM95 z_?{b!7u5ZudU~`v9_8{7ymx&BdvX}1lg9LYC>9MYUun)<-F5Abg(h++0TtQ?B&(Tu zXj=yEo!*|j?;E-42fwUwL`)7RT&L#ps`56P&o;Oh9P6FWK=lcw*d^tyY$c*~PwB}A za3eoryYe^Ms$i)l#3wMim5fEFrhIaBPg(RFu;ls@J{p@fzwKyH%PXq9TTy9$-evkS z=}XgWi3lJ@RS8Yf0Ca*CsfvsF-d;X2FZ$8_eM#`fsyXpwmH=Dysko4@&fwB|Np?yT zchl{ALNTgXF6;y`zlOl4ZGJC{re94>{g?0GJ8-zhNnM_zz7oZj4f!s{m&}CDFE)D7 zE0xbL5uEC1=h3R(osD;y&6je+70dcYQz1I|zDr(^{%;N?Up(mZ4+=7A*ah)^Rzl5{ z+A$!}*<0_Lk_rT)u%qX;jsK;K~<0rrMN3Zb$ z{irA73eudP_13C^Y~#j(kCkH*xNcrAXp_!dW?x1-7%$HjJqwHtjNMBNz0%Eh z(sPQpPabWM-5_h}{Z%Q4r#4RPeH!tL*qN(*RRG2(^{Nwd~&~Kx2 z>Ks@_*`c*lHI52y>=%j%PMNRYjz$a|aH|`l!iKFN6cTLnS7*SwU*xC&-~*GPIbKJg z?pWt3!*^s5u(b?KoZIg>y12$OwMh!pQHV5I;aGmG4cWZl(1FiCVE)5E0x6bsZTh`{ z6831sXDTGA%?v|dEyEU;bmX*Ii2D8WeHxaW91QpW|rg|m2dg3{C0`u*C?kF)=44giS- z6;*@+Fa6((rBM8B)W1zEfxp6NdGzvduJyq4r0J$zz13A!f)CUgf?8({#h^i-8$ylx zpRfs(kNEo+;@hTfcs2|qB1{O1kp)Dgh3`MJ#3R0) zWwqD6Erh2M*s`hqyzNc#FEes%-uoLIZ>LA}c=itdU?KV?*!csS^x7$c!AKe_5o>8gVP;2X{N<#0JL z&8s6Pi*z(XmNPSLu>|rnr65+2IMd}ni0Va1F}*PPn4BxV3jOPXr++5B7!(lbuJqxd zxOqh2rTuru5G&~4gBSnrU|qkvx+wos;|1ameiRb^f2y3}{;fp+C;fj7ZTo)?``aPI zn1s1xN^(j4)&V0Tjg9I0a#c>huf zoVwa^(6kFGJwHEB2uiN4EG;c9wnwB=LxuB5HE8_jXHcnt78CyBdMs6#qf140PGzN~ zA}(KtVvz)-_67gN+E=q;R^d!ef4##D6)!H!S!1JMLa{ELqrU?33DHOvf11PXp|z(Q1%!m_=-*-OhmGL3pps*l(-^JjziA();@E}Z zA3z=gCV@A4N#l>WLF|DC6PGe;z}xxb4U^)_of4L7^fmY5Q~AxIwTFkA;ZKX&hB^g= zEL!yt=9XsO!#&+6`?<%fU8ECFhOu?n@Mdy=ilwE>iTuZ3(a~|yadC;X|5g%KO3f(@ z9&)(fFW;B|fP+0rKbshRNwpP3J#%G0|JhiZRyQ*uLg>)r+amaIv za^w8B)CtR?i9XDN9dU7e!6gC2+;)Vo%-rQ2?`fTcuRorU?+ym7uf)Yl#!1;DuDT3z zB`SvCq^)}=z^=|nuK{Qs2*q zBdwK2`owiSuJb|bRFIn1?nlq__(@HQBj4=PIQ*+@up+iZ zkv{Ys1U^=5H!%xZwUcGSFOZKTHXEwB*^t5BBb`mFgiq2I#3_ zm(6UXDY)--&?rnq84THEIqiZQOKlO?MsRz~W;&sTA|ZO$5`?5Ko8EgZnv2bOGDKu` zp9hI;hpVuYFWug;cHfUwciGpm)um2RN2rv7Pah8I^MV}j33DHx*4~ zxH}2AzmMb<6i7cV+501QntU`m=A2Qv#uD*qqU-Klmug^y;ls@dd1|2N_K_!lC5x;I zg9I~P6E)(hk8A9;GL_Ha-s^`T*Qbd~`rDHEH}ioHmtJ_E{W?%igK${ES`a7yt(28> z{ya9pDws1uOrS+gQ=}&CCL_ZWezr??&MeA5l+C6!IK+0xygY_OAyn0Z514&j>eX>E zO<7Hoi36b-iv>RJ0{m2?v&jF2ejs@CHQ+=nXDt{GkN@?lW_wR}DO?nJ6sGvnRvL!AwD}+$+`vR|PU3B6)EF>Ec`4J?8z4ft+j?F)H<_ z5CUJ#AIeU^%`J)UfaBIF+dKf_vqfi8x(vcc@5I!L0f=AX0Z#T;G+#k0an!==jc>f{ zFsz(>pMXLVaV$pWdZ2S8lT#7*{TAP>uhO+wt+!7%@0$oSIe?;y1&2s3`Zol zxerW?rCR(pOUQ9FF@2ce>d-XsTx=JJm-?@=O}zC%=TN=C3MDO|C-a+y#I3n5x*6Oi z3;3E52l1LdMYiVx{Z>N z>)2gIr43Uf)yTwc^KvoQ7shP&)54dN?J1b$r4si8ui_ zbBsl1rgwNhnxDS$%WoK-yGww=Akxl!>^lT3U^>)S`5BZzUoVB$@7ru(ExIu43~Xcr zUM~d(c#YLf2TZ9tmFrJHZH^QirxU&q9&Y!^Q_sTxA%aEC#B1YW_EY@S2Zb_FfnRp4cwRLaQn zz}|_E{1YtZe(*ngEKdH1DZf*~ODk3cE7Kl)Pm*1nyI(<^RvS8O!a1*lbg6Rrc)!h1 z`rckkTq1@Z1!MlcojM&~7e15#d;tTx5#LVu_Arx`9f1}D1##jVI(t4Nq&TKpkZO`) zuI1&i@S?^47FFosgs~xb_?TR`qQzxat3dKp>}i+kX5v;`%SUCgSn=k^!P*8-|hI>q#gjAUBhiL`G()>etD@3l5*x% z;RZD%cO4(e#56mZy?R@o>M6B6Dx^7ZsjwT5eeH;wpqDc zodN>C?j)tvl^hpofC_XL8z5^E-2d^GX9`dAl{P|6)RNkUvvW&x>jJ{YUDciTw_@G* z2j zB_*~#SbSYll_7(GJ(?rVFY-9~ZQA;{5Ia?=UW+wrv4Tcg=dr1$ou|7p=D_TaCQm(m z<(N=E$D;ZMwN9QY*m?-OEjV& zg+|BiJDE|Tc+l^a8P7104h$%S4dD%_2A&pEtL1dK2HN)HYIp16NV)esbR5&TjuZE` zRNM*mk8E;2GoXKD6Rbt?W+I}=t&m+L5cv*k_Y1Zj;ge8H&EF~;OR8zs?mjU5Qn$Ut z%8k#SUr?Szyz+XDJ?`B*(|ZtmBLr1bXooCPYkyZX0L@DzI|^tnhVt@Rd2KcG;#()% z3dIu>(lKH4MnCg#Ni(UTYo9STv<-7VEo4>MG{;HNuB}bS9t-~C%Rl|SdJSOzt>SlV zvF4MJJlZ#7#mKH`)m1*HKlo{I3G2|)9dz7@f=S4ndMU;ZGgFELD58n=;U=Mzj}xJU zOMT$YTk~EYRBvdSj;PW}KDS+Or)F-eF7L#B-Wh27{t*5jEZ_y9U_cLuX4zuD#1Xes zl2`GgEeAhq+?YN~^TDxyY5Y`u1BFBCgxcO>R+VEju76SEc}TxMZIBjD%x?of)($Lb z68zLGQv5gH?AMlYlGruNIHcwrNpooHNU;sBgH&Wh=FOr6B!6r$ov@fp)p`QIF|HL0nKjVmP56t&!JD2>U~M>U^J$y90L z4ALrU8t1Z(xe4ncDnirHNOSFk?DVH{9ECJU08 z4|;u!a4R*o2=lV3eE`GeA#GjV9uuE?b6fHFc;Hy799P=gJOV<&f~K;na|#3R76U%E z$uC+Zg02$Ef`83^s0+JtdDlgV)NkiA6t3m#9{ng$huho?qC5vh3y})Yd2p{b*_GBD z%8hLZLC=$wpGzUO1=$gEDGJ(a-mn>q!QT>uPmC!l3jWl+qVushq-d?IswNFMPKbjUQW_!O@^!ih_{A>B>Y2K0O-S*z(C|>?7 zbKAIgr^W~AUhAGa5lI#LboOuDH&MH^p>i?c4=%D+pW;hv+vdLZ*OqDzQiDzu$(PBG zcKg}{T(|(X^2LAEHH-^P8Aj?8iLK)0c5T-zxaQYyCl}}3P5g{f*xBrK(n=>OQYh#L zKI~}ATUmTvs_=2?z4X}qj3TB>)XYskH|^V0gW_aptuJlMsr3WtgGny z`l;S(-(==+8_B99A)QuVZ@;fVX3*R3VI%Q*Rbv)^1yM#^nyv1>HZ$cqK=AV(BI|#% z9dEbj)z1({xABykd5%~+bIr`~(np6o7h%dk3J1~JC#g!HmZ6bzdgw1@iJzNs=ZTCi zmr+C0rR|3!$8Kob$|YnHpWJTFC?wT)&~ahG%ct`UH((dNX@@|v$M`a|_=d=%I;<{z z#Xx_h1Ep<@LpuYlsl8XlSw+b-tg5A@rWAh81p(cthJ5#U@)_%Rl!TO ziZ_Wc0`f53#mLJ~-X8KE1#RYECA)Y(aq>6iI8J9C3mPeyhvoF-ZXRb$e#MO+d!=Zq zh&R15Jw1k-cscTd6smY~ax<=sCrx`m6{L_EO@vB@J2^R#%;OMa+c+(se*GC>;1`z1 zXPFe2-w9pwo?V&DmMGsE;>gKNP&`x<^3?nLh8BkJLK%WVF;R02VlBp`LG(2sl>+kWiV1VkTu@|XH<#Cvk|U^?y4yt3NI4p8h^WpU9M zEhZ)*UAUg#I%jMGCb}0$euSiw2r$gl#2HEG7Z!~Cp)@?6W+^5S-)ed+7#=r<`(#UVWk&LSf`1d60ZDPt@i$kfC(iQG zcnj*^@lceo2nSalbL++}p9Ug29z}xw)N^}Zr1n*fS{C#A>B*jM7qieIBGh)#Ov|%- z#g+S$=(I;npt7(%@%NS4M=P>0be{+w(uo^15#!QCr$x_$);c{?ULIY}26Df1%d}c+ zwQ@$ignGvaLRTBN%r>ZdxK9==T6xoQ+0Wr>6ROXSMa#fN8+p^_1+F7s@jE$B@ULw1 zIG!bMsrPbOXWwlh-#(UrS6{?VYf!RAVOV}TIdrp{QcY;-Qzzj+8f2{hUR(owCtz#!e!ekZL=13Mm1yu*|UuUuju+_mCsb_WrMj~3~Z)8k^-9oa2S z;6)A@q^`N<#qj*Zsbu7#<5#qEdnaAgROMP9N5Lesf?|N}*r6IcMQ)(e5`fE|?lOaw z%Fyb~1@rGWL>nd%bD);;M}5wal*}hb6_npRWOKa{BGY`94>*sT*B%7Qzu-2~Bj1^! zN5rgHn|`=>6jm}^gv4)&-o4+$!0ZYp2tXl+MnuxWaI!=*tOa}PMW52zE5OSq)8{Sx-oClDy3XB1VJ#1bLQ=8UIoICM zHSyg2dI`ddYS%lm*}9|Iq3Lyqf=X!?%rmX^Q`z(^pYsh(Z1`{x(SU$AkL861~zp_X!?PJX-VmmHX@C_f-k3EKgXcx%5=x?IJCDR3bM@h-E$qt)q?8 z;JvIYNjp(T+i=f3$U{Fwg#w?r-w{=fAcI8#mK4~b=G{p|$1WW^-bs`pc%9LD5y8Eh zVC!jOe@9RheWKMTQe(_FS^2lX&k_`ki6h*f<0v|4CJbQsoRAj;jcuqIM$4)c0c4f+ zY<-eif2R}=4>K$jXBYh_j`xrbAgcp_N85v~HV>rGCE%$-MP=mk&tS#-e zB<=1jEUG<@=sl@JVM-|E!n8WF#d4zq|2ou0i+f%Glm}png!syy@v~mQesr5aN0D6L zR+Vrh{j%CX@o(pHEKa@fAG@@0uHH^T2Eq(1tCc^fgN|Yt+nFAFKTw4l@;dkUr9|AI z4*SJ4tWH+hoz_?sR<&`y-8!BdsXxs4n9ObG^2AOHwdQZgEwR77 z;eSD^-2xyrR5aKv6?NB$E-J5;PK?hG5K3Yo?IeC3E1y#k#S1s5#KM&?k(dw=m+in&*6^FLu<{ep1*u>6fZ4wFu>f88G#tWC zK}$N2?naD4)7D&mz69ct**^XrIeOR<8u}1c3XQdiDs8@QnEq6YM8ct8DZ=qN2+L!+ zrtscRN4;W4CieY$ zU@J45;_G30f{-gpN|doTzmJ|nAI9^K3JTO#yjvAPFFC(bLh7*D)bHt9HzU$;X)ErF ztwMY59EI8Hx}m7n9>tbvFq z`>i%nKPYZHrjc{-+pOqH*Z8O!pFswzKsCw4b~^?YpPcxdr|5d+R| z;V$lW|FF9khV=j2ChPyz6S@C?(k6Z%HM!Lq+MA+G$fqgY`{qI&x$TCe?P^W`5fqtW z4u3Mz^CwdYqwdnKj_o{?nboLKCSs`4OUOx~dP_wnOt1aDN(s^)ooy6gnd0F0^jXh6 zA72HTWoaZMR{zDO?Z7kRGtEyJDJS%_vv-X+Ptq&fkgy00g% zlCvFTDY3HtFok$DLm&bi>c33y81-m&ir)0%s+jgf4m|il({6_!mHP_nNTh=lTchaZ zWnZ)j@;t(%V(Y`dx@SAQ1wL;6{Vk^Yh24|iN4+N1@zD0=xAOG{R6yj}-;KwOTtYLj zSqon%1=Xt%drpO@OaG9z15ixdfmj=pKs6%y@XfIt)_RmWZI8lN5^{4VPfr0slaD>} zp~%pOorLt-5!LBevhOtk41>dsRCXGR8@?Ou8I$Wu6QW;gSR0%r!!eQl4h&W4ZQA>v zE!Y3Edmd`NEISn$;INVl=`Y+W=Nj3f!K>b%cEpWN3i5=Hj= zAiZ+-D)mRAA1iWZ7Rk+&S|AaAb2R>h0>#T$1nl&u=yPN+$TJ0dSPRpY=jGA*Ou8lFe4+5mEVI(|x`TVCm+VFE{6U z_*;mfLz_wgJ51%8S=0LI`M-zMLFIayQhERc;S4KRy9ug0go%- zVXv-1PE(rykS(KF`C}}#n2xrVn|vwOmMeOOry)$O{6sw9elD8SRD8X026Yq?KT6Ze zui;~%mN&Lb1{ihucpaH}Z2YE>BN^Z9H75#j1)Vx)rh1QS7i{97Z%*o(@E(P@PHRyl=btI= z=-pIySK^L+4?yM~F05l#DsqPk!&_`-eUpOxSz_f>fI63t^VFa2jITf}9=Upzr+GHN zW&aEZ^!B()lgxejak>_jAK7C45 z3uUL(pIiE3viOS<@XoLXcPsd<+9#JU4~xwfx5sHkWSxMfpHt;to%23b zFO?wgW}uPnE?_K;#k1vfGzGA-oS4Ib6r5`yMR`aJnH0SE>cwJ)4f>>OwMiNY=}>oc zSmvj}o12BL9@6~rx-$dgT!bC6$3;P}7tlrV>7Xp^qbK{Yhk*{eiRKlAupre`Si|!V zOXk+Km5EP}S;X)jshXUPXaX8_>TG5$O#Y?mp5mE8U6x1MPxS9bu za7sOyaAje4Rd1>p&?C8@Fe|f&g*Cr^tPw|M6ii<9KO3D!_{!WYjGb$dR&EAozs=@W z?cwa^loQ~a5DCgLgWPeAdFE)ZU7KumZ7Ue(A3jOA%_4EcSo>qlnotlG*RvM+ya?{)Onq+;S3~Mc+we-wv{BzPp?+K{8xpNk5 zI~WFW{7v<|7st(kRGF;5S8k}JzQ!T0#l~Dyj=LG_(rRF7(^?}ttzHu*EndLN3^JlR z62#*$0C7zjb`$7&i8&fBHMJ-StdU?`TDRaw+Xh~K;Jm;8y8^7Lo=r#?gGk*OsNIL! z-n$-$ufKMER?d^HcJIr?8Rl^Fxj4bvWZ%TL7`xOyWryZoZ z+GCR%Y@!>K|W(DVVDaEuL*lv4CK$`h-zR}+A z`fn4G#G|L&hw#rc~!_5V9t8^Bc$6m#Q(Uy=v+nk_mU)in7tOchH(#h zcjD(RBN&wU1mc3%RJ1A8+z&(RQ1sC`T=U8fI4qx}dS}e}3!6C>af@lmJa0X?9UTsA zA2y;lmnw|yY;yvHA+J47sxo{z8&W|y#n{gv8^q_1JJU}OTwn8hgjpyYm6yN4oE?fG z2;B~i`2jLXu_mL4HO#qgPXhWWdoKRwI~3Gi&@H$hulAxDN$iWN?-)P$>u-EMV3$p4 zB->v((u~mc$I7I3CF?4`+ZN(b!N$VC*6TE1Ps}S!sNBs?Lfoc!UoVVb{mGFLCcH@j z5wVOtu4Sz_VeWviOf~}RY~*P`wt_SRlw!O|s8;>cN{_Xi1C)Ne^?(|LDq_HJ&eMCy z-~_X2FcK#Rc4YTSwxOVW-s&w1=iORXk)#aW_vrp22%B)`_h3p3c8B{#0}e~n33qGf z8$O#Op-~s>UE!6s+oJD@Ay(vJh0RvtS6Iufdb5^u4_@9Jk(v_j7SK&7-*-Ab{htlK zV63Lb@rdk%ILx}!&4}gJsy_?7o^J;`?YBbZ#jq-IrZu=+VMoNwADmIX4K)~cf;9={tUDHUe73p2n`UHW z`1<*|C@{wjjg61H3sZ1#aO~5KlR3n__sq7S3voW1P{Cx8tdJ7 z+F5j&8+hhu}vxrPdmP=P{wGN-AYJmI-n5-W=fh7H>IncQ$lIV!>?8gXr)tW`B< zkj4q*;${ZB(-KpABxsAd@`!&Qa=};qe$LCv`Xd>2?q}yC#r3a3K1)csRf_T_D<%?GO&@PE1zb=4K9C;8UR`eYh9D2GYhQ1ueo)Qi^=wsPi?@Q=0IuQc~_&T{i-Mbr> zB=2=x8JU5lC;L$`0HLn9K(lFZ^ABv3oCml;<%j_o z09(@2ocx)CJF8jasG32iOT zlzdF*!;Xv?5d+QRVx}qreEA2JDjrAfS5ud{6dN01zl1uzQlRejZEkil^h*Q#w1jR* zTBUH|Mr-NerqTfAo#a?p^3+7uGv)61{5K^s>u!e&ywW*`otqmEG8juOrJ5+CrK796 za&qI6i&WFR2t1RPKrCcJ-UU?WJsvk91=tPz)l3H5UsQSqH?xOf)atYtny z)`B=RBs={2IPBa0cwZ1xufi~I>c5feJX~kbMVSd)%0AjKXd7Y-qPlqKROZL{pVsnT$#}{UDH;B2M$`H*={(VQJ=`AJn zkaZt#$W3C-Zp7nRP$j6<9z_{%U~kDE$7M@FzRH-A$#m@3Wx9GviZ19}&Z3LjU;^Sz9ulLLP)YO5iWW67S* z4`8ASORO(fwc{%TGtS8< zGoN)Bjc;uHFW5OV-ui(nmyO`}6$h^g(6)sJ$0;PlqiSzxHLfBI-*KtaNDG?h5+YQJ z%YUx^LBYGY`a0b%Vf5w#KWodiuLxr2Rb2N~BlqqsG9YITz!Do{9Bs7!WDsa@kr*&w z`FSqUJvclo_EOM`g*_`_lCxhyiq~s!uoV}1f$~B9@q<+n$H$-WPfV)OG2%@v7Z0`N zU;Vm9uFk@Q6qz-uWj^C|I2T+wnRt*2e&kC2UGUjtEz-{(Oz12Ndw*CLGEgM9$M^%< z3XSucVpPf*ps2{FxRa)4qwFSn(X#MK*_kOp$s63I^XB)2w6wHy8N2Y(7`@+bwOmK1 zTge8c#k%Vsy-BRd-Q8@4+jd(e-B$%<@WWSvzI?uLV;VHPUpbzhUj?WWG;W{2T>+0p zQ>Wfu+_9u2Zr|aBwv&PPy*5QNrk8=bNOeJor~HLHD&Sb+w&Qqc z&yv2Z`{2*CkclwtL)L|9(0NDOK{rv?wMhu!1dMf_8o;A$$(KxMcRlm%tJ(w^$M>6@ z?e-0j-&Xnf=F@cFG7841BmZ2W$NtIhIE5`qsAuGF44j)!Oi2@X>X2*C`c&L(Yq}l~ z44IsTkanAnC-h|1YcIY0v+IsJD70+#thiZJz|DLJi;tSZO|Z{KeC0E2tPJQ+(_=%x zuYnaCQyA5s)1$V7^#jc#gM}Ql`(`2~nham=Hod$XJb=)RW`@h{MFJZwEx0ohTp)FLP`??mNrR z?^Qggb%5tbk>&@=KcllKs?8w#pIabUZ+d&858MQ8J$zp+55TFQ`dyZLVV|DyKCO&} zO9~q{fNrDYnKjEIPA1{EegcnPYZr^{bVK%hq~9)ymcsVt&RYUqZFOd`=|Ka_^#qnE{h6e+gyozs|$#aMYcR6TH z%d+t-9nW=^P(HrI@~aE!r*YM-_<(U9T0%v-6t6B%_}+6Fo`muGjBby=T4KcH@gn{yvzaHFSfpa3q9Ee?TiGyqG-3^ zIuzBhK=1r;4E7yKnb5S@b(In?5t5+EJ}V9WQ=3rQBTX;J69VR7+g3uBHfC8|{)V7R zsHBy7Tb_$v5m;)WuphkQgqIZb%0_=FMr_Y=ibODBV$)nse7^4Mg@=lkoyE-`n|@En z+#pr8=(L@75knnA->$B#*x+k>`;A%?A<~~kQdi-df7OeR0dfP-y@9CME^~z|N%3^jYuJlLm)o_xqnVlG(5o#S9eM*+c?Q#<0RN2X(6cB|DIbRKCa-VySD^1p| ztG)pTj_KLi1r5>wUD?z(!k_kEj=7seeeR??DELXi3;%7QeGu{Ge7wEJ zgyW*knE0~^1wKq`*9|K?UH5mBEg^3F+xh7^FCZII-0ZwE_RgM14@a-Bog`hHfvwMA z{&|+ZiVwQF`*PCTH)^zLOH-1gygK2T-NJ3%gPk;41FVbboxuH&H92tp<@Jf|#}wY5 zf%CySTz)gk7K4eu`x&$#H&lW(=-jIYw{px}T#~l73crn>jIkCAwfXy81UAx0%CW1ZH%d=;J$4d>v~NzRWH+AhOGzGxrZ}GJo*eIKJUR%- zQ$!+{SUeQp2o|)zmlR!;6cl2KGVCIugu7W*GUMCL%`aTRCuuYt7&#miDcETMn{}TT zkE;g^-p>c>7U&F2#k}!_$M+`$q(w_sA5nAhhy?Z=UNObmb(q!hzZJ1s|I_uRZ~0gC zy8&YTRmj_-vctKnyPVSM>b5y~6pU~MEAb%p@AgKJfUuF?2!oK3{GVky%)R)7#76Fc zSL37|>E&-N651*vPYT?!PG_^ItzYL~75Y8>+P|L|>68;RcK5!i=nAQB&hHGEx!kkQ2P0R)MO{qR@=!%IN3NQOg5h3wz@1~d+dqN zCHY|`*Zz75kpGLgw~T75>-v7%BE>0I3Ir%_1&W7KptwVU0>vp7oIr3b?heJFxD_uF z+}$05ThQQE?4{Rr-($Sz%QMb1&WDq4*?VWKwfCA?d#&I6&pEL+f%+EjSEtcYvO)}F zqF2%Dn?6y@gE+$VQqJxYd0q+&M~P8emb7e^=6^_aF{QROK6KITX7p!_mvh$qh49=Q zel-{at$a@0n6p(9*bs=>Tb#37nqrhkFJ?YD;>>!g7P{uQ=Q1ApTU>58QBa*%V^(G1 zt^8o3{AtY8iRBad8~$xPGR1@a;~d2hLHH0~)7*UD_DwG8ev^QoVd+V7*HuH?=Has9 zmpa;@KQQ%Ru#mN?J=^-|7QUGsrrINXxyx!-PVwhF2KPbx$dylRZ<{s7MY1!P1H|ZZ zvZ%j8?0SOI(4RUN?&U;85nAjlfk{sInRuyVb2HlVXeA%sGGbsC{hBe1JtD;hI({Mf`NJrOaMMsT+8_!PH@I z$(#YS8kATH#8zXm>6c&fyygKcf-tSQaD}jDtFIVuy=P{G_Ls-pc_XFGuqh$*X=IRD zt}GY#zyXs$>MQkgKBt3txVb_;NPml^JppNjP4;G#eAih}<)k~s^AYZ)b;gjPA-7qu zbY^%FIlO`(_0ZySc-z{YP^q7Af0)RCYm;7gfP2=L$o!DvFd!b&zI%E=Tx}#8qa=D$ zHTpW(OScj-?BjEl=J~;SepCO;+D=a%e1EX$-CPVAW&LqX8!m<5HD_c{cK3w1PlPp^ zqN?)niiShAa_Fb{iy#zpE-Cfb5T*Z?lhAox_OPn=fVr#%pqY5FQU8CGzF7^jX_pcC|;l z8~3$?(h4=iV{oqQop}!W=QpW-}R2VHV@4B!>4cu0>#v-&apORDLZ`JXn|BkcctWGozdZm|fLXBpFmXC!S7A}kS zx}dK<=V1_ieJDcJ#AG<8zig_pq3k<-!DX|?N*TMrhNbU`+_aLsF}seU#@+<~#sNwY zaUZ63Cw8+BiyUzumqe(J*L6fwGA^2`{+jIiIFF2HrEi`&D$Cb5i1l8o_us@HV^$u# zU`3(o`UEZ*PV+pv6~Aj-8*9D29NZSUn`cO8JLLZJ4&0p)N1V@<=r=Xnk7H*cFZSv$ zy5>8>o!#}lR+$1xj?Be{*{5X=yA?1KhrfU6>XNTF;D5Zkj%m6R(D5}!rvEOMesksX z2s=MkH(gYY@I!HLl#BLl`;uz#kH6-}5Q+Wc^+b_3G3b}hD~dO6?< zR?hvGoMQO2t|3K=PVAf-BCw?Be!_PjT>GyuI> zyGMU!t*@FVU6+9|yDu@-aZm&TfDS=R6_1g_M>XbdubvqsnPZJqWRxMwg&$N12>=w7 zOxtMC*||55C;ZW>V$R-`klRV;2l;|=MGwhV=IO!tFhLh~!>uviriM*l!E!F^`vYmi zTvv6Sim+&!K846l!(TeZhNHrD%cqmA7LD|T$*%R7wP+YlvRG3c8b{@gx9o@HPhpbp z7tT>ZNu3DbspB^Z6A7>zvhe3F2|!&R@HC+2a}Y@ni<}c-y?hu}f?s)~@I? zSoXBQMwz_$^j(7lbNii+T$}T$YOx&BU zB=$1U_Mk&S)%?wkH=xA3V6 zbz!rAb8$WEd5PrtR|4?=PwK7z!O*|Zli{u_4nol+1mvD&uX^t_*zQL@{7_tWGzt)8@Q@wdL8y9*0 zmbn5IW&7V~nx|_+`OR=}T=J2c;7{tmCn-nN|0Wxnv77g`hrLc2zw(H29v5e@r;oKe zdqG*4dqa8{@L2sR>)VrvgXQlOsJg+=nj$movq=pXgpi+sIAziCqYu2VqvA>AeSMXk z33&fVk!8jV6{B40q-dK^G-Kw*KSZH$>nr^hU~@gvVcNY^kj)nD%^IJEt6Yva7d1?9 z9Xj`iVBF`$Pk;IHLnE<9jey&lOjw}|p?=?qt}^faW7}f?Z8*UV^z{m;m~x?lHF=Tk zIwZ`x74AaYP*3hP+oCIyb)L^32{WAx!O6~!>U2rn?pR~G;g}iW4py_Xm@*rFZ?bdq)37sC(v8jC1O*$e%X+UPqMlQOw1>{f$^w1+B-`~ zj+bnteKYKWWK$5-<@&s9IVfRLz@uXYkUMG?h%UL>pr0Al2gVF7xZ=nlJ)V{A3SQu{ zsAL>vZ62954)w>tkg4%2$Y&&U4L zec(o)Byhl0R*SU0>e$2!!hJH2t}^(OGI4O;J~hVuSHfi2Q_i{$a^Z+|52x5En#VN^ z6`%$kzmW+Wo={eDNZ@OGZ?bQfJp602QJ}uFyV*$mZAxvf#y{5*U?<%df*(0y>LWJO zfxmphbnCHLBXe+zT$e$n!BtwECTz{jX$CnQ9SP~8EDD=5BTQjK_#hZx@n>tn$3ewN z5@?5Ck^>!q@#-FX_02*^6=dfWe6H)|$aajBs9B7)XJtskN^4lP0br>DIB=BLXL1oG zIBwk)@=@q?TG887qWj1Zbi%!F|H}dh6>Sxr7r2{72SXGwQ2LX)!1U@}MOA+W9NyA} zIH2N)n?AI$`&R!3!>|Mh*d14F2e~v2R?Pppy^8=R2HA->&-GHP(iJirn#|0x$0<6c|QiF z2287;)H%D6au-0u%nrkQjZzjMw`se zFB!Bj)3H>-u3m+o+mJlS$NyPnXPX?cK9r-0#`X6m$WdhHdOfRxd9 z(phKm^6%Lg7z#FNy{`&G&@~Lhjnn`+n^_q)h!$piTVBNq+kVGO2S_e{qWJfr5B9Sp zWgsqp6?iD&2SNYlt-ak!ak9kr zUg#^kfsy0OtL(*h?i3@^Tc68U$?9>I^_lBUo&3n6afuhh2&{^6x>B9^J83X*_P*%OoT~5f)*CIC2N>0t@1kHD66lp(?}W?Ezmo3%qBct4Yyxork>l1uYO4lc1qXd~YG#Ikxv3F$b6 zPNnksx)~}1YIH!MTHNiTrjMQ01xo#im5kJFm}`v{2@bgwzJ8-$6Gb@N(bn$#Fs+*m zkYU#4M>B!8}}9p0m6Zbd~CstRj^E%B}`-kBk6x(M^n-g!GSV4OD4 z=tbqAf1!3SlLJpY4SstWQmIb~57sX}-T@NRtsgi?k81))y6Z^+?3BO>#19W+%C%VdHSSqGX8h5qN_i28K6xh(I0bK{VE6au&)pV(CShLnc-Ffv&Xxws= zx}GJz&dfc|dV}EH?^jF_RQFD4=bk-tPKQf_#w;hvYvY`B0$4Ie9BCOBFOI@LWfV)NHcy1@9{mCCDUGN2$h|b~ z$JdxfDb%D*aD}=(cLvx*7_zlgu*zrg<${HJ7@oqx#C{OeoGx2zFy`#koUk=GZhDQS zq0(q&IiNRw{u~|V@Kz>RZXz&xh(sK+aJ(zSJx2T6Vi`2CwvQ>naJW-@9`}s;T1lap0$Qx){iA=z6s_5a<<*Hv5cO_hau3We=Gk>Xu^I#*$5X_1# zIos!5k}$T>VvpBQVXtFSQUwTkeY#;^M!^vVX(ozntm;@wn06 z=A#?O&TBHIRGpwVywWs0dnZ+!42pCz=2{#jYdQ}>qYJM{uqKk0wH?TYU^mgwZ`L%| zaK#llFZRbuOKJ8;;o=`U5z=MaA8}r*DulC%8PR3>re@3PY9*gGKkLV1 z@^d5&tB;QEX3d{r#*BCoF^^UzGd z_Tq<8AB!9P-FeXw34*TiOonr1JyNcEfY%8#w&CVkQgvtAb?aItc+R{>7uj!g+_)e( z<~;Ux6e69>B_R$d+u}WkoVy{G>8Yi6zl4(oFAOcNE3)%_`iMtu9@!78iLSM;^J17Q zqfGcITDiui&0y=zFdkOTUb8v>&B(K<3E$Fh#BpvYQZ3 zPBE}`GFPmQX`YC_{^i3ZiGx6JEt&!l?*Yx`2523}hewCowN&)lBW&VS&XQ|e=QzKn za^XK#bK(WfplVJUfga}y&sr|hXs9En?d=%nE!SW3;?wHASjlU<@4jEujnHXMD72=H zawW0q*yUdRV*<98M1g+LhBi~vr#UbYu`To+HqY(08Lz&!Kx;ZKer?0Pi$M@h(kJ`# z*yZ+7+uYrR?!x#-bzQ)_)bo(#yrea(oW5pkozjHK#U7R};w-SF@2IA7{bc+dMk233 zXvCxqDH`#dRj-cJ7xs|JxO!?2!bo?O6xBR>H}>+$EcnN(H}0w2E zh{;Cv&4nW@IG}9JEyBdE1epCzJD@bvEJs%vKlAVqe@~YY98!;9<%n3aQxqf9G<`ed zr05sebtS5N+K$xq^!H$7Z{$L>18YCp$;VNA0+i7Y{s9v~hVBuhQU~V6&;TnZxWLJL zPSr}n8=ttJ_0QjvP%E0i+Z?AL@#9tn6w1G(l)4sr+JR9}@T|(3WrfEHN&6kU>4Ci6 z^^xgL1zMhmeL(nO*cWPQnai2HUc}*f_p93|jK?nmCY{E;=0mHox;H~4!{CM?v+Jbl z&;2__7fs2242^yEjFB^;xy@GI&{uVG3_# zPz>*NkcVxbApaGp zlepdQQsb=nk-;o=OmOcjXk#p387^`9xuT6IL83X9=lom5_rs6b>4l)vCsTG3B;bl?9{8v zH9As2?M)j8W|4LMl6GFS*z#WHhhEG3Uv&&{;OayvvzOI8;}ttFe`7SNi4Wz9p?9jo zL8ffM=)Heg0I$l_$v-5R-A7K%zp>i$Hy@QV z=SAdE{a$||;h&jqZkWl8q)iEB0;h526qF++Bp&+FkHW3c2dPWDB%`ph(a%=HgFL)X z+jaeWtONLbIiu~pvR^N|ACj!03;@RjsP6GSfsaoU>82mVMOF_C z9C4@jScs=7|8*WfK)5Vbd**z7{d|$BmARdSY%|tPD?R3I%vCyRd8r#*2*bf_mGLKk zx>G!}!6-j5Iw9K$?XJp@!`-`twTNnC%&U!cJR0O4;ZA=!9Tk%M9l(gS1CTmecIqQ1sB~J4$b%T+N%wG z)_!cU>q2_|)trS`0Tsq}V)7j>df@4Y30i$wrLTB7V{MRm!hgQ*Di+z2`kvwaysSp2 zc==cw#Y@>3tPC5MvbPisJJ_MiZHMwdxqQ(+bmSd@S564hC_*RayHa@=|o7r0_;Oa552NIaTM+@`jddv{Jr}O}m4E@Y3y;5rx2|U*1C;(nx5+Fba;f@gT$bZ`%(tw^i z0ev4mx5Af|)2880Fuh@+ zC7oGE+Ckoaht0Z~y;bJ!`xYF@BPPmAitk~#9-}wC1^oV4C_!p{F1|ih5zAL@urD==6>>gh%Mq>Wdl-pF#@zwd z2uIFO#$F{F4@7)k-6KOqyFBi!q~3rLAS8GTRB(mOT0KUG^mb%G8I9}yJ|j(Ur^Z5V1MDaPEw9Jteb`3Xq-0-~r(c)2 zEo->V7DFAJz7I;Rg^R!6wR5mpC2ZCYmP{wa&}eX{6PFj^=1Nk8)Io0- zZs)x^!=-y51pAH!^b_h*R#1U%QRW?oTH6t#*NVOP2Q4`v^^0+v{t?cB--0Y0LeomJ zQU9da@%PHIn?!K8oB$QH><-9!(f;#>Rin6`;4wp@&IKrazwxEn4(cx_EOM||GpH1GuI00O}SVCqTV5cv~^!GH+xs|^v zX3t0VYT$e0cLONQ33^B{(HbW9cO%#1%iE_Cr;g}vTgPK>v*0k>I zEXRL7J(DV5vnB@4uvL_UL47cWs@GlS2--dXgKNg@`#HNYn1t65aF%{PbJ&q;QF~ko zP(mSO%e1ZBvDVI7ZfRXJge01we4W6s!B|H{2 zW9FlM3P>)SPZ!>{1gL+^Q&sXZG017QPS~lPzbt@WKO{`f4=TH9vScI~MTn<=;I%S* z=?f&0VdvPE{BgK9Jq-D1mt(YJJ{)!$&L2j(h(~^t&`2wzAI7>JnbJKeS5=Bps!;jZ z3V7;N&7CKLY-L&T)QF*(Ev!K~{Hb|v>pC`ffCGA!WR^jo zW<+q*2HH(wSIppS?a6ZWhuL*z$kmSzjFIY6h>qrEW!a5E?+6sz!D)X?8$e-{)0Sx3;a@B;W(ynLC|WNMNp>gsWX0n(V*4r z1OCG*$q!HHC!h2yJ=W()qR-z@GTGY<7w51KC7etR`jT^{;rRce5p z#m>s8MN%iTcizrm&zrVA(@Q(9lYd@v{V~_$^0#qSqwUrz^7<$ku7xGG?+PwKZrg-r zXQ!<>AwbRG6eMA%v7~||VHA)bY6s`)3T;+o<`!`GY*PcfD-R2ZvZ_UIZ=<(~R&9T! zVGsM}k8`c;*Ygqku1NbIC&Fs4QAz_3l@!Wf-2eYFuVXcfzp*-NHgBNP77c|6^Q|}A zPns;*a?`SShrN^epMlWQ*^1v-38oJM=NC_>Th| zN;hQe-C&cJ;waHQ7J}ux|NJyo@AGD;LZxkd>{0qA&ZBF#+(KVJ!4qG1>QY%84Rx(S zP%if*9<$n|m4~`w3(Z92lnq0YCh6`b?DSLRRmEj6rKEJnFF$e4%bdrOVBMC)<0uyR zXnz%6C$^HRB!Tv7@i+H9>XyJsp3x&c6_D`~2mWDGiOP@l7vJ_06-bDgnzGGR0#XwS zU{XVe_n4X|V1H@3EOjyw^b*A*yCOy3WOeMLMtnzdA(-b1;>i+{MaE^{j1r%>sSo zddQcsHz2I!7f-Irk($$8s>Re04h&bp z`(F)Y>4_k;!3!Ut^tMcHDx2?;w&XR| z&7(&?A<7+BSQ`1>E=rFXN_J4{lqW3lE;7{c`sw0X(+^+;0~+N!5@J^w(Lfzb!X``V zqbtSqX0^yWj!Yw8IjT}ZIzcW{Sd8yRDw$qf*~~q`WQ0BjoJYUj;4Iyl?WeWc-4d!( z9#FWFf8qYj8@cgY4rbSf(`^cdXZX8KpXp`8|8b&}e--{vK#gTwLPOWpeaWs_50iB{ zV0VnvE@;P39Mdh(&#?1G)GRIvpF?Fo{ic#+5*4&qc51flFYN!NS3G)PJxy~NlKy?9 zb8wAnb2C1zi_Q;qrrRW*_V#Se1mto%zi!_xIUbgi{52U#-2&1~Z&h#Td-CsNBjcK5LcAZ}kg;Cg%8qr`*_dvnzLGtAn`9x*eCSoz#5 zXn6(@vD(I`8>wAk-tbZnopfOf7^vibPL#2k@JErDDo}NDBqTIj^@FQP4k<-@ZowGK z7y0+1>F|Ef8e=Z|e8EYh{)k>X5ZAQs zRjZ|e7Odz@fX_)>OoWbfS7*%rs5ivihL0i_Z@PX}dO(g)E^YQZWSRGuwboGPNXzU)1QIrh(ebI$QK&{ky@Japu6BLcVRrdvaUD1#X!k^ zF~Oz9EF+RS#An*o38Obj{Ucld_UOciie$pBJp$bJQ_Nh)DD zPA~iy($b(8c&Ci)klxtV;Ja;x5>kyO%Q2ezTRhB6x=0eYNdLkH`8L$or+&iUl&1w= zhld-HdOTnxW<@EXk(y~3#@^4oD=3P8#|jU^-6!sZ$45Ya7sf4WDb5{}c+?uP4zDbS z9CvSz05uLt9@g~YW7og3+D(Vg6UBs?ZaG$X}B@9tJ~R9|_*tO}++{6VJ2%GU6wX__cS?U1Yx2tx^&5FR#2 z*}rKVf#h=S)a>GrwICO}X38+EEUlJ)l5~uYd2O?1uE&t^Hd2ox6>-s}*ZCtl5#e&Gm|KATOQWatU4ZtUW~kIQL&Njc|DpBxJ-ursmnAE_lFDtn)4AT$BSu zS%yOpM96^wZzJ~G7saTJ;CGvAdtpoZ|3tK>&inlJF^kFjXozjk2ixpq(a>j!!%Oyv z^9g(UX(+D~45;N7m0|+y?tTFS+={Z?ie1!C_;%R2a$?uqjbbr!v{xG9Sa&9Dy-^=@ z;x^Zd6w!~fC*5;3fkrxpbb$_s8fZ1NSzCWSQa9QnXrp8Ra&t76*YRatguPlQ1;@ER zXWHM%K&*yVo19Z_)rweLzShw*Nl3TR%JzBYy-0sX3_RqQ2-lJTN0;o;K0=U${C5>( z9K@K)NjOk69bAq+DXgip=Js~s&}Q_+9KNli+`bG>+vhwWd-b?cjR5w;T+MfWQhl}p zid~(OHXSy;|E~E4&gpFLNhi=uaoQ=@(;L!9lxp0nDnj_<%<@**3eY?Nc}HU^5h+M) zXBSqy*JLEf{ zOGYqLhA4tmZeN8lZH>^`R1T{PL>JUpUxd-CnEy3W9YUoZ06 zQ=uByp&9_}aM6HIFgn^h3kSfW^)md-fe9-^J3!3Swcn zPfF}k*?zlyu}a@%ItXlT_D?>-AgG@ci`oR()PGj(nmZ({vZTeCwYLioD42(dBQvFA z*i)OVcW5f5oG$yBBi5TA$Xl%zIUqT>H*5NMLW<%Z^n8Roe6ihbmk^J_+L)2>XHH6! zNWq=c#+sCRI4`fh?+b>J&Cr^$)cr-jYxq@sZ{!1mRp_QWWjb+r>K+7d&t44(TDs@VKN6R`S?B(^K@| z9_GMyVw-b=);PVy(X_abcY0+(@dH>nfy5xN;PWe35IsAl0DDoJDq$RV1$Yo|M(d9t zD7(1}aOH2tp(UxtMq0w-qEY`Z3xH6`R~Q&b`RiP@k$S8ZpmKWj^)I`gq45q&Rt=sU zyzMpK9y=Y!{CyF7t3}R&e=urXA(#}9&}0}V#{_0dK-dI`2+qjaV(4KQU(XTylFv51 zcla5HQbJNgAE>IPB$+o>$Cf{D)5UAAEl7M*rn;y$%k}j)Hyc3*9j!-vY60?2R@fx4 z+r1q)Z2n3LCi_};w+UcT^Xy`$Zz&;{AsZIs``Fwj}OoWn1;HckwO8K2wzZL5Sr^C zaeA&Yn$-)oLQ3szXZ5yPtC$1^;V40bgXrg7YlKGRI>By$V8V*Z5jw2gGyA@%oxn>k zYHC-;udAU0*?Rq?DZeGZ`|A)3_3tz<$>8vyqprBTl3PC(#Oe*TW%$)K=7)*Z`{8Sd z`b)(()l&Q5mYFcj&1?p~XJv*OV&K5?U{lP>#w2~7Q|hiuO_%nJ>j@LI%{o-eV$`)iLpoGaY#ym5{nLWFgy(Ext4fQM|a+ zbw+7OZGyc!qaujlsJS{vD*IZGD5%*VD@{%JKn*mfvq6l8K-cndPb|L1mW)gWm!`wt zkXf(#&uGx;=!nN~?KoENsx^0MY)mnY5=E9*-5&_kSutR?NUoRZtvtEM;Qpbr8W2(+ z`cRhZ?mi;IzF&RdUkcO@D&4iOLfoye-G}MtB7SS~*YklKsdGxU4)?atCm00>Te_N` zu|x*?&4mQ@QZ8#pvMcHwit(^@4Sy%Kh0%W(h@m)$^GIv-_)4I@PPUmi(}wdq|?!4!Vejm^vU(w}BwA9mY}Ap2@GheF)f>{J%dS%kEPrY|&7Mo| zw(Q4tjBx!%;O-mgc=R@s|F`-jFF6AmnHD-H;3xpptBcP>usd>+bl}3z)<2gpQ5Yw> zCYuP7Kp78@e^d7KhNI(%_a?#a~fMHys!4tUlu;u-~xz(*O$@A>Cg_FWuh>nGxN z9E#+q3N*Socm=fu2;T7>#YGghgm5$PB0@H+iLaNv6d7>zQB#AYWy*sM390D?`(s8n zzL3tHwxfR!)T@0-f&zs137U+IXE4;ffX9MIV|6i@XsA4X11J~g-)dxsr+>=+NsKd- zKWlxaS=|Xeqs;YH1g#uxVPF;*p=S@hCohjPn3R_860f|G)4_8XFeqvB9N5R#9j<8_ z9q8vJX;$xcabm^~x?bC81`f~k3NA))Qoq#BPcQ69H&Y&wp5Pi;V&bS84PNbuifdeZ zzQegDIT4QAeC#7;n^h-O)`Fz8cY@!bhCoyER!<6Ft!k}LZccJ_@fM$cB6!D@>UV_h+m zAGPtDcR#!wncF~iDag1RSUt!)|3 zTE9=L)=ewKy2XFqAro0X07by7gNu2o*#{qVCfYWcFfWR zh7wtWdB6gm7?J+1-BT9-B#%+ZH1hU9?F~PoF9nc8V#rtY70ZUfANAT=(9z2~xG(YB zL9apM)gN_3UmMy&Z=n@zr$#+c-u?%xGR)CA*b|_nhb;*jHn>JI*f@lHX~j_uSo9wg z_HK6{K!U9$BV|5%`CuK!w8Z_209$Du9MnMMUq>zv>d}}0o1G{&<}aUcoQ}iQbLF*9GHICG`ctc&6j|MkFt9(yiBOPghG)KvdlYL*@mKK(AEcA3DOScN?il& z13)op3z9ZxSWlUuge_f-F`Bd5wq3O#?s>P*@mQ1>19-PpT>X?R^{B71>XRzv$TR#dKW$n?7V75P> zzF&!X1(y@x6=Y?!k_UapEX01nYqS6xT+)!)ImyUaPd={n_A@#*SLo0-O`Mz=;gOo` zz{z%42E**!vd8RGWkG*+zJ-!j#?PFHF)RK1Q*&nsL zwIEbaNfR5Z&E8}%d9V2V+x;pFZyT=OTLO=eorJcQ+MKo#p-W(T`HVlY%O5HY(Wf`1Hdmc3v6Ss41N^qWZ*PfCSf{L2f?6p&EO4;Hp1^BKlGr6 zPa4jW&k(YkEmz>|Q|%V#<;E_K!S?&AIHdOZgzea&pLMhx^>Pa$b}6ua(R&_`?7vb} zdw)&nEerH;jQe>K#(!$OfSG>&hY;?){9lwyj(L(ZTRC-Ybd)^RkbX*vIlUh9UzPJ8 zd1-3NzXzXbuoNX>yX1F1Nt_i9%aZYq4gb-L>(pd-@&i{zCJnTFt0UQr3;0izpRyG` zaml^7R{_7A{?R%o_7Y^9j~R*2_otEAM-B!Y;3UTRh?D-k%xlr#BT;2UCSn5_#XeNA z(TpJlXYv%5LOg^eg_i|zeT)B}@+?s)38H~Qi()$;W<&BvpLFAEp z1+J{mE-Rj?lapMg!?Nm(g#Y%wSF(Ke>7%Bm=5gHq_yK^!ou1DJ)P~w$V6r!zj|dz+ zY*6a+a&y1ILj9-C^|296;vi@^g@}Yi^UIgh^{`Q|+e0C4>--bq7c*tLtq!|Y@C}-~0a2gli=Gy~GtdAA9{b0|)6ichZlc z6&%$A6EGqyLKEWN4zwi{^#%t@fGgrC6!^88R^Tst=5PN&YOremc z^G&ieG&I$vrP%*ApQoj*ZTF8{{bMP=rMkVC7}9@q?9;QePx{wv^Y^Un$)Z``>rDSX z<5lKBv2=4cAC^1OzhD2CCAj;ZTHl!HGoF|(u|>m*m!-w8o?n~=J^b0fr;j7~w?kZa zbdXy6tt$7U=6m6X4Ie2=&&^~|M$hBzs^8U;`w=>icjnPFrh5;_hZWc? zRO#pgB>(h05tsI4oTxKO^U7&0nJd8dS9sDwDH@Z@%~=6zAU~Rctc4zm%U;B}qeACa68BH6aYDTOn-gi;%by9G_oI8Kn zXWc4jA$phVzI?Nutn*y$&xCc9m2GVfC7OvUBlQcY2+Zq z=A_Uokt5_KyY*z9qncIK&$3f^V`@40qwy@^A@ekx zZBRFn^7io3E%={u>%u!TI?ZnLtaXc=Bgl1&RbCf+TRT~Ug&ZoSKyIeU-}WzTKQ$Go1h+#u;KVNU+odQsk?O8m6hi= zlh~t3L8Ea?=M|5$50|YlihHA?5Zx0&?Ro3v$J6ZS%G;F6cNzhor6f!SgAIZ#mTzVg zGd)j>gaO>^-u;A?D$ik+*I~Grqb{La^5YNekAKbsSikX|T(DmeLtB}b&U(mmK3L?D zq%I3=KI~1Wnhr0VQ?X@otu(dSyb`_~$r|2}`sEq5G@L!U;<68MGS3TY@wgvp_mXdH zsgkx9ugWz^#?z>veDgF=$CMgE5PE#{-bZuhJQXH<^f8mwUcJXb5Mn6NT=w$Nf|sg@ zS)GWOYE_O4;kw_fzdgXHAfcQk6BEA6hDmn$i=BIb%?k2+r~LDkk7)bsRKiS=f^U8J-R7OUzS`VH>f=|uD#S3Z z7n2Ov*?(C;UAS&^Lw2E`N_P((Q|^xFrAms&RqE)+nDU={wSpICvn{hFyjfweF}J80#WPfLa*@h?6M|t^DLR>tY%SSd3 z11mmjklLV{Grl?Jbf>*xd%Iy9CyqSeof}w;P0wa&C3E4lmzmk{FtgQzPWUGO0;(;C z8H9p9k?Z>ckW6(^E5-Y8NlVmtIhxrTD{KMbZp>)f-|Dbwy!H8xnVG`e%Jd6X!Owq| ze>c|=+vJ$c2_PWyQk5#2S!u?Xa{1G-V&l4(iX(!U%=B`wwR#BjowF4>UZ`gHT)6&` zBU85Apz}*(3j$^hONrSw>z(^%q{2k0WK;z!Qr2hW)F>T1zmwt7a51byOw97WPLfB| z1P*zw<>2ymb#KFaJ>-cNQ=>GBgs)S5qGQ+-r~$KXrioh*2g5pm(izXwsnN%4L4h)B zGghHS`u%0^^%mib+*n@E^X|#yVhI*5q7{dVZ~5tlpf#3UD>{*0`ls31aybEa#Ldl3 z;KPTWkWp?@1^vtu!!VMjVoX#dloo;cZJf^sDIHgJ<#Jx{jqbTx^+&x7eqC?g=s#wD z*^1bmZhQDpD4e< z_DXFrJuSJ?ewtds20zl2`O;Gxgl{ZaFZNENJ@utx3qP>(6JD6A>V=-YRF9uhnY-1d z*t4a)N0(+o*B~+00do0>0p5nph&l7{VejKDz9WU@;~@efBBjF#sZHTOU4l0xm3E=+ zp7_T%FPbJ1^B2RzNCKvO5ok#B>=Aha&KUr%P)cIq?yK0HuA+~;v74z4JoNEQZ6(nS zejGyjJu^wVw%Knvk)CYpjtW?<#gwkdrw9>@&!T!H%pCn+6i(;xon)cL&5f!Hl@L zXy(w`r?U8}JV8>AE>{yuhOu#RT!~93JAsQs*r|zkx88Q~-#gz8x6D3XD+DnN(?-ii zB+#s5H_DXv#$<{9l#OhwjFWjyCQys};}lOLDJ86>=uXqrW;x2)AWWQ2I+o9u#fkBn^dZEvvyzujK1X1~;G-m>NPrSmRaW_h;WsP4mmqA8tmyz3wl3PKbRwe|Drx9Sy(xOuKSF zz9tYJ|EWjv<(F>0M%hL@VW-2A@?|Eo9u7RZ&(LahLJ3E;!$tLm(?n>oiStT`;(Alk zrRH2hD&Cd}$*Hagl5$`=6eD(ZHUxwa=BO_i(*G`7}=R1m0fs8b9YR z#&kz1$&;-*bu;oDd(>|5lKb)QCcZ7@W^jOfbMH+04=Czi=AFc$WFY6rjE;V-W%GWI z;GRAFlWVqg^n>X%^JX#=!onn>QuXUJFG#QG%tK)p_u*tKJG1#h{$XIH*}6{n@|3S< z`-9*>9Mg~c^({Vi3{H)r9)#p+dU;b(p*RU&WqMc2k+XUQ(%g0E<|44x?|0RU<=np$ zUPam6WQwkC!;c@4NenW$QU5UD+20 z^d^k*7kMo?1WrSmI`3}v?NzM0x-%jwoCyy<7D@ST`a)?|2nQqiwOik5T1zY~t9`G!RlD-> zUWPnieWv-(wknEm!MBw`9|G>3uT(5|`fD!+vF{JW+4$XV8)Bgy{C+1@taS;PGxZ>?S{5$;NA! ztS{|pl&)j=oesV_U0QKZ-#tZFKHiLahJ@JZutj|{i;*^~SwQn`1dX=O%dXy)1WqDhd&dtkz*5}XKP+tA*%u{#%$F$t@=hU^54p)JbuEtIvgqjmdJs62FX;+D!TYd0{fyx zQWE@oqglxME)YW7{y-!O4b5EHHxo$({XGq^Y+n`I#6iW#OGQJYTBT3JCHq*pf$orM z;1!K1a%f0inJRe5%7Thtb=3^-{Tj)mo8{V!qV!WgF@5c-Oh~1(>Mb3fhm_z_LSVZ_ zjyZLxW))Rcr6u!>v03aWjImYBNg3Ytd_y>*C>m`>2_2W3t;rO^H}&NmR=eBy^M+nO z?UCula(?r|DTGOI!;<1`-$dFF=}g$ab+g0s$XSk$ye1YUv;wAXQa!cIO0c!r-qI7> zAAUf|X=Ri!F5-flo{N|t>>Vm>;#;3wzCJn#?Vs#>PERx*3nzR1T<%VVphheGqY!?V z#Z&8`p*6Zh!zYiNl9bX&7+Z}`b&lzoehA~CGXh`{HaV!WFpgXatArRR<@26+T{M|- z6LtnqMzfYKT{o7ip02mw)}-_PZC)v>DB*clJaMw3VSY|XPh*bX*ZD=(fr;F7#3iMb zpFTePv=PLCC`tv78MPhBTA9zELu=YLm)4oh*5R|piVF9+dK`sJ{o>TF?de}4cNJ382`G`EoA2yg9fP&b zH@Jk5QxfA-ej#4t6)l8}>T2%2Wv!>BQ+Y~qb`6P6 zbUrB$##(2yFrzahV>LvH&~GibVc+IK*A5f}=k$@BF>7-QXnFf|kw3Kddzg>=gb#Im zgzHB;yrCpDS8SAuQdz7R793KzKJSP&i=WXZ+B(~+FK?%831ez#bh}2vkVRRmXt6NU zAFi1-gWkB(C|#wFlL-1$Sy9&BUJIStK8YMNq@Ofm&#C7zF&0;w)c#nKGGag4@cI)L zKZQi(qoSvEooU97aHuP)e0mLcG$ogsU0h8hHJ8#dQ#xy!`DdvZl}uGnj{Y>5*qlq1 zvbL{^!|}?tb3rQz`sj5gmMSiUlXg>CS0_|rBRjLqwJJ`~wOIAHqG*Q~ADO1upA>$H zj5V?2Qd&BPc-S_9pP8be`3KmK08)*pFvviW!e zP=S9ui0bS!a8}g)otg&55M;+j$0Ye&+gn4S<%V?eg%{QFsrqoR5>rwW%>=ZTnI7kG zQYn&QCw;w9A@ggKTDZ8TpFUfWkU(iO3TRhWQPIw2eBqQDop7(-{=(D2sgcj+x24jg zi<>K-TfhnWG%QL5{?xPCzqvv*d})HF>1jC_!I`L9klU%OgXbmM&c&M25|tJp`-L zA2A-Sr4!ZtlgAt0{&#tMdtv(AhVqKC_~@rlSL+=i$_phZiTH#%!X#<|zhCo6SsC%^ z)Qx|pZg#Ks0{%=*lhCON#WM>Ch!*nAFPs}|4Xh|CqUX}y%c7} z{L!+-Fz9obSf0fYTnYxoX+Y<%)PXH#uABRA0OkSuXnH1k_P9CsS({W_6~-C$Ka@s7 zr=c_oA<|kjF}bxcMzhS$Gb$^{?ZAYGmTPAT+2I;xtx!@TI%mtG-QOkfK%i|s?sH@P zV1Q49_7L3X55MPHj`5)gO%&4~r;A%UlTQmsJ&5t0lqLcgum&aw`C~609~n6tw{`(b z-`hp0&Gg@A8>}z=-46%hz7ZUT7hK!9_%~a*mVQ@W{nfFAws^$I#$mCR4g6%P!l|#X zpTB@bRn}S2SsIFgL$n_s0Ig^wEbQ8{uw>8H$TnxKAYpS+$Sbv_r%vNN4H#eH468$5Y4-St>+!w(h7^uWH4vJ)pp+B{dXM>S1gI@V!kYv*ly| z>TkDza5KqW;pHmZ1hlaDDQ1jTreYKbr$i$3IMApD%VK1XW$Y}R%A$eB?j_)ZE@V^u zU0q*s)Ap3ZEorgwj%x~``-rigwZ8Tv&-$XNNW#`{M+Ah-%A)3IiR`Xs!jM%hO@UHz zoY0q6eDPnz3Z!vC;Wp!R>y(TdLNLkQyw2{iXu9lWoh`9Ir7v~6_@YEL0djDaMd6JE zp@Op-1uS=&uD7yYZDH%mLdY4U1=uv!+Fs@Cb(KX${V`=Sedr(UaM*15&ZI6B{|aE> zS!rc9=VTt$%t0!q$MFGB%Bf92_i3X~_L`1u)b;Q6qZ6AzweM-l?UsLrzf zZS0;Pmk15qi%94z5EIuq1WM4sq9?FEi}v{8=u#Ofs`td9DtJq>?^C$ZSxAGh{tDYC z`qVh6V8iq;_a^YRVQLavG)P3q%c6(x|<1}(2BDtjvN?*v;w_C3@<&zjI%;&AITRkqw z$Vhrc&Pz%@=%0`s@ytelkI6+YpQuEwd=Nr*pPgad_vpw@8Q38acTF5oU{X64ir>B? z>eFU6`YB%UT)(~`(gG-JEcHH#uy9t-Wua4{cOHtbk(woefm8m<-P6a8hXc~%FKeuT zEG$k6JmU|RI{QO?T;M3@EOa_JtTFx*%WzP0@bd{LBH+J`5Q$ zJ#&;6P_x6n3i}n&CzTN^i=QXLek#+{@o1!S*Z7klPRvAecnvk=W+}VIm=-lXw-nkR z)`iTXB9y6x*-~LkXrgW{)n6TDii7mY86MAAszABWeydq^JRU!{JxsPdOt|3U&Qh?N z`x~`YtCbCUdF*7Lir9AfGQV+q5nZZmA?|@K}(=Jt@RQnuG*Fr0wiw{+ogb^9=>H$c#ipBp)_-qc33jc}3NUo{Y4#SOF;&ho^~f;W}JdU&rI6 zJlXMP4m~F$J<)MpSIJ~*4g=r*+J*P&$p^EjtH7tKfx_NxW~P6c_%6YQ#l=#3q8`3I zf0X6G#=s~vuOVNAC46uJcfA2pu79tPZX=CikK4w#C})7h)Qe_)R>SFs)cB}&4#NSL zZ4tlmVo9wX$vBE6l(qbQ8svF-#r*up7+_y|_5q@hSs}<_ zF;5a$IroVBQ50k?4O>$GB~qOp&qqty{%&D1v;d-mgnfmJlR11J@RZT8HWxgK;eh9x zks*wB20=QnylJGF)AW)P0A%aH=y_aGCbQIh{6f?0LE`=Njh!h2nWXd^7u~e)8kLcbv5-xKl2r}Z>joUvc@Qdhg*=U?2T<&?QmdB>iIZthi;CZ%fpeKQ>SB! zU~DaBd5m|+LXH;#Qnt%pWeg0XT8`!%&84*7uIj(%%vv$syRxC)Vv5f<#k!4Nd{%`9 z7q@Cd^8Rgkof=7k4w+w~rsih0-4hHYgU9S4rAyo+C|Ceb5^^a`+;U$a!?A)lM6Y0O|AN+Rl{9yRU9MFNb?(KidYWZ(w5L>T4 zvpF;kf%Cfd&FXuz-DCj~S{FRn*m!>{`0Xk0xFahdyhV+Y;5Uhrd&W@73-&X{a)3^S z7FNNi?LJTpEgqok8Zf^FXp#5zY`wZUj5U|J)qCLZJ8A7g-xcD&@e=F{GEbQB^+Kq; znVIAOUOUotJdJ}Z$j{dkSx=L}drkp%KcuX2t=Gt~{rBbD_hwl0e3rv$>&?3NOoGUp zF0!5!f#lkQ@Nl{if&}luGJ-Siz0TuY{+sbbd)`iF%hJm98BqqGUi!OU*%}9?7TTAv zm+{!j5ryF>S4el?+SlR`p;WPq=LdXTf-EX8Z_}ZR$tMe8f4hZl>VV;e+TYn82VC&~|JJADYV|!f?3`rsQ&>!R> zoQb@@P{CMw386p9D=)Sfh2 z2=0d!N0ZBySoOC4z9!_NJ=LoZCu)|~AK=%Cl1_Oe(B!mN_GbMOd_e+(?>hi)#MSjU zUJ-dfOQ*qTeszogVN+z;*H08d=y`H;l=OE;^v5-J8`0nGhy)_2twiBKoRgF5NE^C8`ABF~n#NsAi z`$L02!}2QEzmInDpVDP=Orf}YEw0+XxFWRu&gZiih{M^@#1$ajjZqhPFM6o=hR*F8 zvrF(!d9~@9(WW7JcmeS6_ig69xj28#C2)Gh3B5@AYm#B=igkH_u3trg>p0F{?+ZZK zCEp=mFN`+Z=l7=p?^T2v*vErjU{$QaVpJO#xN=^p+dqN#dpIr}OqbTNkIE=F7$kR41$Px--Fg=HHY52gFn)lGEW~mVcSbsvOO9C`meT#Wh?HRJ6WWJG}p5( zdH=WXAxQ*E7g;<4O`u>=q5>S<4dQl+fz|?7ueRq+VNlP0l=bzI4%NSQQrokG^gnJ= z@m--L4S|2`I)nSA-{X~(eBSQS=Em9Z8~XYC&Aj(Pt9Ey=l@}=b-mNB6xBWGm=MdfI zji${+$CP1hkG>9C?m&-6`ye=n`TZ&y(g||mtgd-2{YcjSoXY8ZhzH?d6oO==XV7kE zZwFTUzV5X2;#z&NA1-%rLq~C0hDcQJBfS~;A>0ZCyBb&`;QTC=`QZV>fifZ}I)a)&)c#-mO?nAp)IW|OSnGwz1@fOg{wpEqt`B)QCBIY(p;+* z_p8b2=mFa-JN5*8UHr<1rIfrHGj!uR_dDKQT@;d5M#i7o)g>QmltkBv?`kQ+h9jfn z2KLE!^BEVCYxNPJhy7prAz_)n&_Q0_*{`Yskcw4$*@ct4XcsCgXB9rFZgh0{U*oec z?Tn%_D?5uSZg=KOb+EGAzs`1fACS9~I=@B|_+E@XeM|lx+eO!H8eg6uWkjw(s501X ze?O14EZ|smFmbwipB>wISaI*?ZmyU0U0HD?#q(|5-tXq>V%ta<&Hc!dUGtz+wDus8 z3_F0>d7Z(}ZPvqg_AbT#?cq5an{>!$uire!<1(EG?48~ZkNR`1@EI|864R5Qr?%>? z8`j2ZElMSq)B^Hb#9JTwV>cf6OHE2TZ??Ln5~VIv;OpIkTv2 zDrae6)J%1t>eo)YpY0CbPVTGhhE$;`UGenBWgknCzEo6!enTb`a~X?Ffd$gVcJMcF z9BR*8^j9nW`DWwIFD`08+|_`7m z>p?tSEZ@_0s+;A~=rZ0Tb!W-W&*v13HJ|r_F0YemI{8lJPzJoxmdD|jCwu-SwUGht zq^HcT&YKbY_vSX?2D_iJ!BHBP?nl-*uxe|Kk2U&yHT!wM#*$?yS^9LGP2{V}EzV z^ZcFkd0wUWd-!uB@9oN_v}5v!(cu6*-TLTnR&VibeZAF6vB14scLrsm(w*7VH?Lan z8x^0DsCBkB-y7r`$lNwirTBT*d&%e0)g_n8&Wk2(e9w~_ik$U@v5*WL7^7a6h0Wfx z2D8ImYrBn?rIa>%z3ZVnZmEV7csDQOY5TLb=eOtc=5vH(PJoo2tGHgD!86by9fQ^% z${y!Aw)LJsqxB}>e%Y*aXe=5t!eJnnmejbTZ4C7GhH9rG@cyXXZ1rWBqk@3_!CJ=g zQWcA1zgEzHTKc4M{dI}L6=OuO;l%E|jY^)H(x47-Y-_W>(X_u$yc-snPkBF09Vc`E z-T;NPT^UbI+%J#vd`b}R@W(-klCzH6*u(TEBInC=M}Y!x%7U||WRIHA*3Zr;f+>=e zZ68+eap-;Ml>4^lz9c&yGT>|ErlSHA;QW{n=cAY>gcPo;5d#V0-~XW8@0s@vP<>6M z+`3*C^$KSxj)^csc?)zhNBZJJh2uuO#3?l32ITiO6bhymiZ}*Q^C;xdvfn?M211pd zt=boZ)XDX`WRQCG;AyDEqj!!dSDyS72Us4zbotc%?x<|dp5(us;rK}u+Ns&AM=9&o z&_?Q5A9;=MXzl;_r*&;lV?LOkmY?8I0ksC^ZnFr!VWSSdZ8%7XT!XM6LJ@IiVpH)6 z{{F((J9Hx(KatvDizV){O#!^(7ngv3!?I&hx$|_>*Q0b7zu%uIicbUm8Cs9}eXww> zJKjs0Y8>5A_U+_m6i<6K94`QE1`rWY?t)Y>8@vuz|gt_B(g@e6z(?EyqlbJh@;O?23M`+u$a!&Z^06g3V+_HisH1DcRx(wsa z-$`w`>edV^yeqfct`!OT{9$(pH%KT-I>ZnhyovZhQbbV2iFkTL3w1`{7~dYN*&k4? zqF*hOr}Y>~A;sFY*?(tqMZ)Z4T+&)F{!>|T?mK1PeUQ^r{{7~P+I9=)PNsWlrEcp< zD#N=|@+Zp(e$UfYsifyWETA3w^4@FzPkjXbM915yj(#UkK)q%TeKEFk@Aqt>2A6$? zT#cfO4g$RdPI5k+3aH{%-Kq|K&Wne<@6=Pfqg}%)N+q6*n#nD8WXKkcXlE>B6+YDl ze5;~>5?Wh)Jh`;ex6b{dY$Qpn;o(Od{ALaT&)1)zMl?A1EcL!pz>Abrp46Sr&s*~0 zwcL)2n?v4<#ikLLYZGZ zAaOdd{!`vlw>ppqx;5z6{fb-YF=Dr*6i?CU1gRbv_HF(mVq2Vc^~Io*B1VDsdHG;1 zVly>HDtq}ByAc-^MzuW9-$}#65O|UUR|M{Aq479utu4)f3T;)%KE&%C%_D~P;>8|i z7CD8IHvj{u;gk_t|0L=Z^bL+ZAi$PgaW2>_P<^+jqRcqWL$s)qCFb6}9TFMl5tR%fxrR$w?^!ffuR{c9mPtgAvD%Ih6t< z0H6^pyAA;dD~joyi?RfnMCWt5x-p0vJZvsMy3)hzh3h4xH;Sy6-$1SFBMd9oT}*=Q z=EDAFc9zd9ALudpAwQxwEO0Mo5ufwVQQO>RiPDzpACMF%v&4%}%1rzgGgEq?eT4|H z)gmB(nP+*%xGn2yzAL7Ki1ww+<9gpGnwVg)sF}cC->^=Tz4?e-s>b5A7S=fG_0liHo;5Zh&YJ>K+_;Vw z$2yeP|M>Lmb#TNa0<&+!!kZ~dozi7jt4h9a%%W!nUC+L?8M$q=Zp3Yx8X8SR^qLKC zB^-}mikd;!A%)|J0uUUyZjjQT+c>VzAAT5CzNE1@t25 zozXhcnRl+tsy6Q@Hl=SQ;@Y>$VIE$CiP4JPeG{x6~|D9H!}- z{h|^7_PZ5&T+z}iwF5~IyxO;z&;-Edb&oP)^c;tSOlnncqf zjn=wiEF%`MG7$6MrKQ9SvfUI48WO*^!&^$KB;QY4^~w9A_$`K*jX=P;>O+_Lc_qUuz8xWXtS_A5UnhSn znBa@~mK0-hXQ$mA=pSI$uZO|!0o>Ue{POs}2!tM*$IpsqVXo|=qmc2a8Ah#3-AKV< znlK5nIDq5W0}dCp{U&ejUi_*!cgwLincl-pVPg5nv4%({^m|kHB@WjggaYW6b1UFet0xP+_{gp|jSCCgFk9MEd=2)G-XGrW~Fwk(-<^*u*f zThU`HD;eu0gd($rkb+HZq)xl_cyvV0y{?Rc)DhgjQP~NS;<#+t7f=(5)%H0*3{am% z8LSiL{@d_uwy6{}$`b`o8lkTdSB06j32r!DUcq0;#sc+2@xsz~TFLNrLs<*wNs#j? zWB#x_)ip_Xh08FDkL;5wbPb^KLO*muIn^NvEF;3&E4li61KgGbxuYp6nTEEC=h}l9 z3sr_h;p+r9*EF>GTXuc9GXn^1Bn9HLa)Sav z)84Gm0uMyc zGTEG4o*S~zn8g_9Kr+(0EA#_NuMwJ9j5~1U6r>5!^mb{roiPr79uvIt=;eCyx?BJ) zH<7KNTg>&t^ejqD*vB;b`WjK+bb%Gd{X>XAhJ)pCug`43p>HnP%>#sJ(ATLH&<(fA z-m5oeeXvQv10kU!w`LvhxM%Rv)>t@}m!yW0mX@$rP@woLc&p+tgKr2AOf6D@EJC>G z5;qO1xyKHhf(m#8+g)hmuyW(Fk}#=GbWcymwaT1~Jy=J<*C@qyb>E4Rh;93a2c}x2 z`{BH$c~0{GKPZCN9JB;xLMrt~< zSt|aLpxn{Q;Je+~;LyqURCGczwz54vAUR8mHaZ-~u+Gdjl-xD~=AEjT3g;5j2~hFI zRa?xXiQcyQeO-JU%L1hRiTjRJ`-c^d%(ynWIhKlnL3UYPS!3A{Ep*=mKt|c;6I#-c zSKC~(I$$RuBBy0UtM_RGLR1_3 zGMie!P|dmyy6K4v`hpcct@O#9KZEKVL%C`eF@HPLoY%FLhTYwafSwI?5TA4K>)H3U z#Qt=7JgyB{6l8{E{&v6RxxmA$AF-XhqPx=xbvByt(p+)fbxO)gy{G{;^09?2fCp3t z-<#cgGi~#qsr_pvDnTbV8m(gz2ji=ozM@t2HEN0U}Q(66>7{yvw$3PKHlZi z>eHNKD;ZB)OOHfO9|P{~eua$`yZGeNij{&E_6Xh4>OD8r(^I{=afl-&Wk(gM93Y`; zEh1u4*)&7Ooof<@f0z71_#)NkW8E8&;QX_sG7p=;ZAc@%hE7nH)D%z{3K@}wo&`f& zdCG`P#8q%tJRR2FWEEg!CZ(4k6`q*$7X%_xZ6BlJCGDiPCT~Nhma2%B3f+p78pBB~?!$JNcordIyL=_H?mceGr&0x+e zgo>MpU%0rlWpksh6VIzM=ip>tqKcdvpPOyW=T*K^Zp%7ITKowV{SYN0A*AY5TIM6f zMXiKPxvjPG#LGltyMUd(gb1yFdIqyiRg1on)+@YlwvZ69(l~v@8^FvPw5q)6bJ+};R@=FYM%RoWogC|jk`i5;u@N#wee2sM zQ!}4NDS7D;`P!3;Io+_#_1E@ru#FtBVwXv1GyP)I(pglkV2!?|jAJJ{2s_E8B3Uvm zcbnH!a99zgfILKiBH|2fZS5;rGff07J0?9m#zepumDyKp+1HIce)$>LdYWJS@lQ4 z*Z$<=B|QC4Ex>TKl@}4uDE8BTF+L0ivmGOyPr|`;S}e%JeK~65`{DcTA@;FJJLF-) z1I03`Y2Q}^Ib;yC5PRn5L5?=mSZhD{xI-1vYk7Gn=AGJGPxn49SM#F^A?I=kgw7@5 z@)WvCAkQ$TnsLKt9al%>I}}RPqqW7}U-Zsi%>rH~rrX3Ha?BnMwk0?gUWts)tQ!0J zLL`rIqJ<&l2%^t3(LG9TBwc5aK9&N?5l2gQ->uk{BnV+i%U{8{``kfRRCM*`bUHsu z-BasM6^h3whx%-{9%AG|nVF0Q?HaF_!gh_C>}Igo?J4N%Vl6FweN8M!6a-k-D#yRbJS2 z&ez2<;=V)p;x$@7H$sjY@ zsDkW2gscb3Z<*{=s{2q|aNXHj#v0#nci=ILvF4L);YU5f)Ir8*Wym{^O{8>XQI}1}10^E@sE>g~y6#4euzDNuUmX?svDyMSkBR;N=v?X704NcGvopf>ITW z(m~AAF?J#+yNVDax@@K9%;R7MuQm zeziQd9vF!Hc4ol6XjZ>MX{;^m%R;6&%==k5ORb}|2qzWO7&LwFxPB}2bsz-BO+7>`*?5^F? z8cL%qK~JhFl$dhZ?>J8u{9qDMMV!Y(4Lne}ZMilp?P@zsTEQ)bxs@413tO6SY!5!j zVN$2p@|Rl&u&hx2CB@oDsSwbv2keSPwF}Mc^{`6CrJ?tk+im{^%3@h;#qQfx`P!GD zs1P;{Za6=o1rP_2%9vQ&9f<{WBP$huJ4kQyF1HA5Pqh+CTAKRdoHF1?qYaCVii~qo zDG2PH+Tnuv(@F2Miiayv{RKIMl`J_L&nyd~@HtvcUgwyfo;AlMxInzX5n?bT!hs9= zXF+c>U-bIIHqO?OV;Kjmv2cHZ95bhgRDxo3aswToTBfGD@~jbpT5!08VzJcGRMMQw zjYh?xcIjxF&BU~~cofU{#W+sSRwhX#r3@Lx+M_EPzr)J68;@juE?%F9y1MN>$4Sx< zYN({?JRhIQ{IdbJ871eU_yn?VsB^*CS**Df^i`O~#-h=J@f}`{Au~GqYs?$PWc&!Z z!jxsRtL{m67jO2R*4GO{3~HQu2uho>k%OsFEhm=}INnjlJh+JRxY_On&kzm&VtR~^ zH6|ON;J#Ntcg(<5MBTa?Bu`o|r$+c_oPZiYNikEjy#Z-<1 z>rcKM_+!*kG4BB=+YS|s9LypI4?VT`joEm7Xh)cmJ~$mNHRnjPrSi3CvjMTazruUr zdL+$39`x_q4WV+=>9V1j?)RR%XT!H|d}opa$v>QCKdAJD?==N9Uqs!^*Y$&)vCDF=?$0nco<{k9` zBXxdz4+i4%wbp9qa}iuPaixA1w~E3UlR13gH>huuBO_xRv62GSlPCbQ;NYQU$G($0 z3r~oEC1amry`{o7P;ey5Gkl%tubXW2y5*9KPIZif{@{~eU#$`xcMw|6p8A{WxJsBx z4eq$Ur4$CAFT-Xr!6|c%(*aq}tZGq?DCsv(nR=SUZ1Mv(zu3 zt2RcrU+kX6CS^5WFt#i?L)Tk-=(u}hwdAq4IUB5I<=FNjRcH_@j;&X_Sx~oqRdPPu8A5>JB5#~p@get#P4}wUz+AmQ7&dQq85M|@Uj{^Q_HiUaP7uMD3R$UT?^Pd;VCySvbY4QaLWX2`Dmg^OYv zh&MyWf>VCf_4t?^)p<%0=(o_i2~iV?Emqz)B(fuIGiDCJ-ZLD=LCo$`zic}Xcy(5Q zmo`=^jWJtL+fcm)a#l=d#<6pLQq+E3HspjyD~V;t(;PqBs$_axMsi|${;Rv^VDL4D zt=&8ia!-B_wih=!i%kjx;_hxb9~$DP@E_Ip3MYcHt{lgSSNTG!GL)O;3mW9jr%`C` zG(n>mM+ol%a`=>Fyw<6%GQbZLz?R)cBwSxzvm|UZ8q2n!+3(-hH)rS966;ZOl~%`k zfoLH`^a_{9G%*Cs85I-1%SBs898-F8x|#!w@TbS&b$0*Z1b+>am`GwtN*Ukg9iQ>T zo^6e`P#yJ9Q`*|PT1%|V@Rn8s6yKp$|k9Z`%`;X74rtJ4}(bX=0C zr!31kqOJHI-WG@Tydc?wX|UgkPXOiY($@X)=R9I?ZM&Y?Yj%!=$={lOJBIQw`DVb^ zNulA5z`?p$$ieASg*I*chOKaaIN+pJ%j`T}x{Nn|2>W5Mwn~W=73V?hBhGZdzkb&I zz*@jDS89JEEfov3pn!xdEl$&>)MH-gtq(zOXLPZ(1;4gV#Qt+u#jhOt{%90jX2FaB zxW$xen-bYt#rK&d8<>u1TZ1zE^Y%I?RARkc`{8|l@a{F??MgjnX64KT?3fF40 z_79f9kz(*&Od7_*qz?BvvBeDh73bgB6|N8uF}Fnub`;0R6Zj)H4z;h_xBkk5+QVo zN2HL0q6j2xR+8zBtUzZ+-K}L?^y@=81}+*7ryZ2=eS;g<9*c33&3T0c8V3H5aB9$~ zIRWr|I+F@AL1d6p%%-lO>QY6rg`|j(K~Qk#%5oaHGz$>W`rDP21XCT6syA4;))ClJ zHF@&;wWmM}C3RGx^(+UUhTlKfV_-u5TcPcd%MK{N4U5oiO0K%+n!z?@|*szF|Xb<>$r8BM%ch)n{!C4aw!SSuCza$PwbJ*RCIa=Ef^%91BFfa?ME?b z=n+vf@KMIDWoQ#Utqae#b<8BKv;t=q=GWW}QCfUFb@URH$m2vv3k#(jLH&o`19q-k zFWEsiW5pHcNI+m8CGYC@FjOLDqBgzg7@VBFv&o$=WlF+9It;6B)0P9ZR;ykQ+mc*N zJ)Mnm_w$45h0l~op~EMrp-LXEJc zRM$UBqww~B{~9zlHXf$jEUqciPu3S@Cyzpfn+sWz3hn?%YNHp;oJQ*goIS$@)U^1O@fG6oO+i(ZHo>D ze{C*fB7&ztW&3J1hySPnM)8XqB+SS~+BhIK&uNxmn%jku^_h2+l!PEIe*9)_^J^iAiUFGCNX4rt#&?LNjY zDh_y5Uc`~Hk=S7{j{QG z%XGvmE7{a^hQe&}<{Fv6`%{M{bu;m3P7T*6kuRz8!9&!_YU0$=$Xgz~xgxVY+xw_q zJ~9%cc(q2=oim|K)^KZF1@9t%d+CppFyq90a0s=`(ztFk#j282M?xy{*?7X}Yf-~- zW`uRC*lA2fStmKS{Ue;A87#Qn{FBVYWkKC_15j$F_6k<5`dsPwh-Ino4>F_gZS?w= z<;C?BlNzNI{t*+r^k{R;-DPDmN{TANSodN;<3lqG8=dRv$af^Yl74`)`mqV{@?f;faz#f(7XI{YRsmS+ipnw`^+AUGlen zy7oVuiHY&f-lZPk+#7rQ88G6$kdxJt=X<=}OOSm~DJSf3N5|2sZI5NwapHb3fiAnY zHeaU17aPKs&3z^#IjWz7KIE)LchFfGl8;YfY)eCrLOZ14D_=tIDGOLQA2BZV0;|yM_Y?Uy(<T#;&s|e>$H(OUgUx+7IwT`kTx=9 zEPv_$rxpN1Bq<>sf3M=d8p0zqzMo7t>dfMFGZ+hsBc&ymJh89=VJ(ZwxT@fdkTk2TWskDjEDa7c;;kI~c({+7 z5TwAyLM~HQasF1*Nqi>$;nsEKuykyi^OUwrKkQ`xzWGr`@c+U@7m;z! zf^MB!aQ{KAbqa-qgj~4sGQQ3tXMrEn(uk-ik-w({ z$5$2?7mtjKcl@Y1qB6}n42@`G+(T{Z@!M|zp?tp zV`UUEnfGqLEWh3hq{YW4XJzFpQ2yo2!S$!na=@~(vWoKZhpnGovV)v;+eLhwe^2}2 z0}5od*BLNulV#~S}#VHw4*Oiu|4#S0eCVDMb(J{ z-=c6Ne!#Ty>V6%GbXsg~&8GIYX)zJ6B?BQzvYW;uQ)Q4-@t^Ik@f{{4-4fn9oCKx# z6F{iex)2<`O`K<4^L1@<-GBO^Ao$}yZcs7d_kRnSKd2xQd*!t6h`X{ab$r$=`}el} zhLt4`H3H)R?T!LLIRr~)s{uKm*@lMc$#R=(#*v@QKkRnabY9R1 zg<>K%|Bn;j?ScrAtGgj4ueVyl>V6=|3$Xsj5%zt-A%j3jKFFL%&eiSj!>s>az)~e+ zN$)=&KUt_Bf^z$3CO=e1E3%D&fBIp=`EPCdhyUSMC;YdL-~%-j;=lC>AJ8De{=L{A zFguTa4?fnIV)oxRcjrO6FJBs29DVHdFw>9_Lzn#A#*{Xl?mpp?MN4Y zamTi(ySZd5_y%r6Q@(@rjIB}tjprP+BB6Hz1Pep$jAePJ;S%z=YEP_&l($i72$TuAXP5MzpQ@(I4iz3S?&;@kO+XYNn&D1`WJgplfGH0K(PoEc)SD{NM7i-xzU(o51B9a zGty;UIfgo3X7BonihcN67n%XBuaGMLvn6S?z+DAP z3og60%g}eX1nVjcQ`WV9xabk$rS2n<-kXIYz-KnrYJMPWYku-Yr};&{0!bHX94B~1>-PZo4_$iIFU5qOpwVutpRxCI79F7{uF zn$%#+`gP2U_DtJ*)9bF-Yua-$h#`Hjkr8!qcz$_$f^>Pjl?`W!ck_s*%?w+*iLvsr zensqvfg}fLV->(s0YTralZlY|HzJu&truhFX0nk-07DguM>D*QwBtb#UdN%!%9h(} z=Y>@4JSS5z9^)jlCMH7d4{=mILN8wngK#42dyRh;_nG7#7|5!CoUqhbz+JaQ+LLt@ zc}L+-3rI55$-3IfZ|f39pS%SW+R82rx?V(4wQ--q;VX<&yGJg<`X9ym-!MT}SJNb@ z*vSIfq+zn;@YWv#UY^`%QioM1?HHH6@^$T9vBzT4n=kqa0FM1WORo4tvR@O5=Y{c- zf^7?76Ghf4eAZ-J@JeqG-ooawI~{egFN#kL*y!I*TGO0L2nc4}k3ATJI`odKgz_|x zQr#Z`jf|PJL2F|dejV{y$r`B{LLtBqjH+Qf3GUpJ+VF#Kxq{fbRhKJN_>C~Qv2o?f z_6;yi%tJeKnTS}D(+l}5C-(F33sXPf$WZox#~d-W+5wy(Y9-yYFDlD6|Pb`^z`obHYq zfBGSV&}1$CniT9g7jz*i5G%I2sAV7NT0aBmv6b9ZpXruLj|gtwIGT48E1VPySL-;~ z*{AVMKAu4z?uULcj9fuW4Wz%dU~BRD3HV=pon>2FZP%^q(Bke;v^d2n1SswrEV#S7 zLvex^_u|DhxD=P*?(QBuSU2}0@4NSxy?#KBd|1c2t~t&z#w>ByC>^uXPzBt4Z~iKj z!mhD=D50}I3Gt@Nx<&4%iz%Gv-oj7d>#G#G54G*4CgfX!d>03Bf8NbAU!ZDF)UG`! zmqh}Duk1rz$B&U0_U*S!pI^;#mKWb+w!NmK!c;S|N&D-x>uIiCkiW2>jP9Cnsu;GZzchhU6#ro%8@4YReC* zC*uNueE5585PC`rx5u>`8iAp15Y8aY;CJG-o!mCkz(MJVcrI1eWa@^^l!JQq-Ged} zqiJ)e13R+ZRo_`R?9mx6^o9_YUs((NVmK{b?jJlzLL}JwFudkn$U4Pa&;+G zIom($$s;!GMp7;tx?6{cI=KUYi}foIb4KAF&BIFITJ%=!?Oi zSYF>`M7%;Lvzd5HL15NVH_42b)(oXt5Vs2ToD5`HDL!sYR!_K?{&H>0cPng>h*JW6JDUiG($PWZj(5<5GM|F3C==C%jmT`$7vO{JF zvr(=Q;_*lYn5KM8o-+ zvV*$RE$1@}@+)?AO6#xXv`yvZSsX0;R1B}OIKUrZib+pS6 z_duezaxL9ei%&U0g%$a1x7xUM8YYBpFA}YA0zvt4E+JBV9 z>*<-TfFI{5^9z;sCg~|MTj+cQKI>_Im&`?QBVx#Br4~U$yyVa$x&GQvQGgmmaVf0G zo;Ex+^Bx9tt+cur+jHM&AuP6vhkPMKAZlWZ0L1=1TZ5Lp^1G&<3uZnOkBP-J(-A z_C?!AJLS^G9d;M+$F%xkE74&QVM9)NQC*NU$%L#fjkZypO37eA+rz@XKvg z6=PP|#9pK*V3P8IXnx0GUN$l5lckV|58eP`M;78<2a0bU`a2II$8&HhGEwOu|NI?L zL<&~NL*WV>;$HoN(-wl_oS6%95z2DedV9q4;fUK4 zZKu)bG0sr~n^`Wl%)jj27j^{#(G4IT!NTP%G?u_*rDW|lx4W&c)}+lap8#dYO4X}U zv^;l9&2n$-E7T9A&;}@J}oHsKwg8d0t zI&1OBdQ4(SZz}8Y4Qw%@VrRt!fDqk9=09 zh)f;U0E);x^9GqSSA&+&m^8{-9xVWWdN=42MC!obb6J(dxgoAZdz~M2OBt!sIv;+H zQ=IM|gdDwH`*zodDP8m0EO+x4NRr7j2|5-BOl%>z8RZRrCuJR1vay6T8B?v!~r{X~Q0Vc$sHb2OAuVsKGGFK#}FGKm-sv0t9MWY7>3}H8q7Jzl3Ap-gs z$V$BviCPh5CS`bQ(j*q8vYJDkv-)?B&A51eO3RY_v`#ShVriDpr0xx5#~xO!cHE?! zNr%>|!OW-{4Xn7pUoHV9M?B&NBOvS4YvY8RknSPvC%P*FR6%qWzPiB5z10fg7>dnc zp}61xX|*<7?IohJQ?Sg#i5ggS)Q(A&dbtmMA zD__u?cz|8dXhgsW@-?WVy$B=UogGF5k@1GM5Jf(f^VX1aG9%ZRibp*j;HGz)y0l7g zZ84`3&nau_a-{~gt=Kk73s9OAm?(s4+gf^<nTvPJ_<&UbgU>IZ%Il_XVI z$7a=d<0hqH9A9R~8GQznN399MFeMqvBaUWd+Nb*{BM?2fWi((|;6rj)?c;gg{HJzM z#`W`nuo}QR$34A?Cn91v);eZ&gJwkyz|&=gdq7)Ei3e0F{8Tqk=2~?SZ=G8+T}hCu z(TtLO>;YX2igLnm_T)zSd_&gsr#Pjd6t}@XSFP_S0hcf%!(RNB)Al5y#i63$ zfK;|zjW`&D64IU|K%xby7;s*{js&*q6OdIkR?}3?ntk3GJcDY+*ycn7N+XnC-bP|} zU-ih-S%Lk&Y?O=g;2jcun*zH}TvGaDRxE(Z&I_QSuGhh^PWIIoZ_E@Cg+Os}%zaUk zYksPup%xnJj_p!ID9}1lWsk-+)=g~b zK9Ln`dU_x68CRcajl~tiCuT}gbJR%zQ?1kLrz%b(3w)JyWY;MSPpM>k_5g}iX;_Al zUf$})44>t7H_0Jv5!0-eb}rUqyCpQy&++@WsZkOp4oca?dBl;tc5)Ia`6o${=bA;B z&!X?rB1S@Ra4@cJ`iQ+=!xjlZQQ`E!Q(tWSE(;(mjCCosw7!qDAY<$g@P0EscU+4|(YlMRa3itezkL%1UGkyzY`i74S74k$iQera_x5 z_Y{|CCBZIM;W96?L(J{qV4IQuwE|y)&pGKkOY5WWJQYky!9&w-;8AC9L)&`b*zqqV7+c)y1RAaz(a# zqA4Zg`fk#}Gd1Q~@q82VaKJ)Kke+l>PNo+l>8aCa8sAfu$>bI)WF)y6kg z?EVr!H%X=XG@ZqdRqj_k(KUUk)Gr7=;z&d8(AEVm$jyTGOa zA+G3YA{hFZOA0wb-pnA2?X9^4ps$cGF;Nk~#w=b6LGzrcAo&3NTQ>Z#G`*FT$VImj z&`4974F7|nw{7%8&D}^Qyo6J4j0T%F}}0q*4QohdEc&{iIm>fYH%d-z(vM!6>ycRQ7C}xnY)kfuDmO{!6Zt^d#9W3V7oAr?mFn)p)>a z%aIgpROzJLbjVV4(qlELK)ws`RNX|bNNH7=&qIhQaX1~bI==NuzR-cAt+^vCv}X*R zC^RA7Z95|G0`K)n&&IL^yLA7luS0AZBL2Wt6lpnAHi~S#-U=7DU|$cC(6xr$>FT&-t88fus?;#CyZ9*?D^`bmwlr%~roN781#> z=cCv}Ut8xg{WK8sf(E~|^9HGE`1m+rksK)s9&nT~id2Uc(G=)AUPlI)d_dUjYazWj zGMom=fCb5fzwjk=xUVdya#HAV6m=ELrCM>qA$&!be-&YWbPm)^#jK3KEf5jxT%lc0 z_3GF$$P3Z(FlLj)F;_sgbI(D7ywwU%+z;-)Ys=-~U~=k=oh@R|O7$nj1OXzfF{LNt zmW#6oWVMhxiY8Apnc^8XfnRYlez8Bx=>5uY8&=}X365-vqox0u_(WUE>Z^^30W<6KG5;0gUobDqPfVV<+OM#eXlDI6Hi5Wbx{TvfQmn5toq)=y7IAr8NU&Q{8~kGJ<$V>Seb zTZ6Lg*Z`Hk$=sA}~TL$&w(` zlYC{>D=;9?@x;1=4#c2tcEDTA{&uEHd&W`raR*X7jFDgNW~mHo>_Jtwa#aPFCDQ>3 z!Jq8puoO*MFoIk;Yn&4~u5(Y2&BAj8&_2ndU z7XRXlul(^s_Y!8krHoYmg)Uwte*7QO@uuemSiL;o-@pDRT>kR>3V8LeQr~~TiM5Es z?qd1lfq1am)~ zV)Dr=Q6ZXDaP;}AzbVEG5-o@3dqa4=)>`bGsyuu;8`F4Ru%`Y57nIzB3YewhC9f^w zqraemVg5iny)ycn+GcALedpGjW4<)Ird&PT6v7t|?Nmv%U8!vLz_swn1srrH*dRRy$2!6Y!el*B_xSh?JtLk?)vYe{EKbbD3!+DrZ0z~Db z7sdmtd2;B#LnwXT{9D?LPc1UFIl%1;f=!}VRVV0;IN6b~yi2^pT-059_qH8gFj0}xjv!A-#1M$YI`CaQZV$L0CU*8fyJ?B!h;o@^->60^XgSAA|QU$ z^*s+Eb+IR572$^1^Wb@*Wr6{WG}Ix&CFkAyWpOU@9vlExS&xt$6fs$RKh;N5PqsO! zX8?$H^s;c~-+cikWOhZc%7SNOvDN|g1Qet$pp+A@986O2`&z;mkv~u>wk+zU9$Q0* zZ;jTA%C8At29vW2wy+64;7G=nWj2cfIH20;gAdLQB3Zd%KSsV}Pcgx?Kr%csAePhYjLu{QH1pt%7Ndb_tK;SalW z0U!g*Iv|N>Jc^0(_KTzpRVBk25S+{Kw}fyp_+{wHZ>n7$^l%(>Fz9TOshM?}?eHWD zv_U)EPD>_MIa%&#DIz~Frfqc0&9@dQ_|^HlErQQLhW+ z^R+B{n)HQM#7EdNI;yjIzuVN~mr$1IFd$J#DVFK zJu+?YLWMV3PAlN}PEtlmFa^_WH2&>nxrx@WjgP<02+#5676PX#Y5fI6R|Dpflj#9 zWM#(;q<#NzqFLkv4IyahpRiEm9VY7bvO)q)V2L$rQIr_pHIyX&SkIUDsFg zyX?B|%dXCrQUP+yMIm*%S$)Fm330S8-cmQz(()I|GZ&IC0|#H4_Y+>DHW(EAi!|2F zCze~NZ86AP|A#j~DR$soy}V0`gIua5K@olTxC4cfqH~&=VGGNKGfygwI5~1H$WXv2 zxDG-nM*4GF{C1>84On|G&%Pq{0vD;0h28Q+aR3gc##h(7^525TeEU6d@?0t%1H#Ng z!&WLu>~?jjSp6a-%Vg+orAqHw-C1+1+RZJ$pVynq5o~CqKfF0CR$I{v{^_uBK@w-h zx!c_)Z6`bAhF7+c@oy+OY^lB%Jtx_wideio^r}>}Zngk;#MK7Cjk%Y~KK;JGLT0+g z^oWY4ojlfGZ`*AWt%MKii;DNr{PpR*Zwf!;hH{4yWv1DZLnsSUZuHI3ozSxh)_lAX;7knV6$klJ;xh{mE%jD(38)$YYU%e_4xsHK1PS zJ5k@Di`&1dy{#`BV|%6EV!&!ys0Z`friS)(^=Md+umq0_fq54!dsTUAddPV|?(S0&9?AWI&(%cZBiSY1@zgq%HqFNnj=JV~@&3u;nfn7$Ib^B77XBJm({36?g+q9LBZKGTfP@?k;wn$ z2gaq>SjYEik7BjY z&gkPQ`R%sgTOW6GQQqvXXU!AQQcuQiVk4J=1aEMK+D=e}cH^LnhLi$ga{VgSWyqYn zibZ#YVnacCk;bAw5nw=`B??(auqEnopmG+hH-X0Jl_4 zL7FN?H{Q5BHxZ@CMS+VTw|cHz`2j0e-K)s~_YWl3_(|xFO~|a&$RR0gh0Ma6u7^11 zQ9U%L>7rRHhhAmFZaWMPr}B17Q5)Vk&Iz>N0Yb`bC@KU7nQ7I$i^iPd^UK4*q;i*n znbvuWbywdjLMtSbWD#twenWqJ~eC>`p1GAQ7kSQ1jycXZ`1XqqG#o^HMJd+KvOHA6{f z(@n)TWwYjGh}@3!Us2IPQ9+Wjw#8OGpB8}~=1v^3s#)29%?f+9Sc!dPD@G0SKdKi7 z+lNHT#{V|ID@kH;`wGytR0vNd!)0k~ZJ0S9rwZSDAc?wK!|RLZNhELRd(X9H2dSvF z?mC}7Y|pqWb#T?AK`DTi5nTYiHkyK1$S!u1b*O|!yeoDF>MB3T$%W13QrWID&>pV9 zcYI7Cj-7H2U&TdRHYk=+n*Sqvm#uXci($^pws?71Rce*UVZWSIQr;!>X&*AAY+K*N ztlVo39LE?puLTAeO+xV9dS$wWhl<@a=5(@zVdWSOwBdQIuuZCJ_bdO#Cbr}N6N3+U zQM0_b3?|)zC-s}1=%WH+#cJ9K%V`{fiRBx`?-mF9)OSfqSF*7*VndqTIOw%eH~q7F zNuZ4lvMtNz-YUm_ky|mr5qVvCBi`;y*6*KKyN0}72q~wuG`{?~ux&7;Dp-ewQV`gPu9ps( zJ2@#2)x-KJI%a9}`~VH*5>RTPe%#`Jae+l1+H1Q)Ih$im?Du)HJjyYVk1dfZ#1iq_ zN;nG6p4uV&5&_>@VLtG8O9LkzWHjLaga9K?s#pR%{$f4-Pcm3 znL{Ckcp96nJFs&{r&)AriBYR+16T!_*xoVZ6CD-B2&a!O_4xZ|5PNo6;W=$M2NGyV z&n#f6wUN9z+SPAm(hl#|M9$q&Vi9uy1v-tPWzTOD5=`E(Aj+5Q+CTQR!q@T#yKn92D zQ&>T)@IlvE?I(|*x=etd(z7v+1lZ|xn!>c27imE>6)FV!D<92OJNR+5sx#~3y%?jK zO`8fdTV6s&H(#lJIQZk6BufV#h@g*E>Jm*@L8O;DYi-p#2N-KDL53>#OroI0d)`qm zq+D^I?_Q-pX45~?`93Z8wdI%>=%@jlwFZvPYSetRyF8C{>a|^11ilq&Uosl~LE-(4 zZG{~yv!RIk{w^%+#1>a=I$b+NgjPG0Am6x_4aw%;BL8AfNpaNDG!5e)Y5bTi6-t{L zqYfN|tuhf2;I}{%m}pE~RCg3&@AIC>H{-vo~x`$?2N$3b$;#TDw zbH8O+A-}|#W8#1#i~WL11;hmSCOJP)t_b3JV8l`9#c80QlGTMA#L9|hICj|Plqp*v zkOi>R^I?*?Jki!O-Q<$Xo3NfItyRSuL8c0^OdPo-fovXSR?Fs5g^)Dt*HnwetLnc4 z!8~r-6*`mKU7Q}0bWXVG%_A7qs&?fxPZ4V{;b)0&#P^!_&XIspXK$LoUQGe@-8Qb; zFX^bbQ}3X58w=$mW}Sb@Jpey|Jv<(g5Nl`9_Ga=3!m73!t|tc{V%_VsAznOUkS1Yc zkcKC~bf)NIhzwh70Cy{2vUC3a7uk6m>VVdT09GG%nwS{!h{PM0-~BfSoku&9VOF*| zdHJKJNY*KPf9nRkF}AVizNe&DG#bch3k*nwH1MQ=${25hYMrr6m=(N#ywj?C(oMT2 z%(2Lt@J&;;5oHUEN9tNg9Q4VmXFgc1$udsVm`;%8)}Xp_u43F+D(7IMcyfH*&pADl zN4(MlTA;#O?t}RZ4GLv_)$A{^DsMpDL3s#r9I35)otik?l5;@bli=BNF0H*=^LSR> zc0c+JR@=gu8>0RCx|{bhPKJ{~cbB+{LpY6h8qIOiEPjpSsg3~YGkYldBxH1@`Td4g z8A72sO}OV%b9c0Gr=0EJCe|^kfOyKHuwjf^EX$5JA9k-H`${EYoCUES)q=QB$J#h1 z9FZcr2H7zzR0X7VY8+ZG$gHz;JRZv;n>%GU6zIZc(pFUp)#r!2)qWNNa zg#1QV`7}o`fZxyStk-T(wG8%}vDMAuA{iRTLYU^Z9A5rmUiV=-zA~kuVs_1(IRgrY ziKo|(EjUG?X~o1i~=EQE#*s2y_yE%((Q?x`LJQIWQNev(>$tr;$bjNnh1 zFGAN86}zf-CuM!X1HNCqHi~FxKCJI&pw}FJc@wN%Yfe~R=2iQqM-dpfFobwwIqg=_ zh9PFXZGS$(aMalkNHi&QPeNBcYU_PB9#Vexj}k8`)!;a3RJQl=<(2xWN~*e81w~P9 z_DEt~7f0K)KR|#RFlv>!g}HwXxlk&Sj2uoem^<}M%dSqaR11zUm)dyrPceuW?)vm! zEr6{8Zn5fFl^aB)_1OdQnKc0>D@4iohlV9QcLOHZE)bYoj9x#z?NlhEO5fb%k8&)jD#kQD2J+)wL?FlddWJt-4Sqg zko~R~I}%9b)as&>6Kya=rUwd^HV195vbO1L+O#0YOc&_>9bVW~;Gw)f}H)_>V!8~BZGYa(#f7{3O6-El3)z4C_CbMy8XPzIUVW+Fh3O2O0 zpOJg*f#C-N>2zR9mqQ7=eTVm7rg+l&3cyV7v$fS8;pn^zIgh}yg`zkg$^*f(2McB^T6j=Wo-MKcXc|4M@-+PjrMEo@4hfuW3& zW|Aapl2xxll*9B%Z&|dTcUplLg#nsX%Q%^jEt}+Ir~B$b_qsceH^N7J3y$GQoq+s) zu#tZ0&E_U&!O-_J3IJ*%k?#Yn}wwjqAuVDhYTkv5eYoT6JW6^ z4vTWWZsmOrtq)gylazYg4E6HB8{(vvuxfOyC>Crr^Qt}~RXA#uTt_^j1evs+ zO7RyohJLvXPN4b2j(2)LB8X;1Vgx`lMg7scuKD--kB8>!qsMI2!O;k3(hb9jVI;3d zay~VX+Mz2LMqfE8@ww2t(RXM$`Hwt$NSV?UFnB@S(DoQ9)PKZbYP~zZ3-fMQ;&H|^-k9hSJHOG<7djZc3u>Cn|hLc(B&7w&W^U%(0g6u z;gjVRrwg#n*qMifFWV)L_2wD9O!tZia6FFqr5OFf9lLD5v9lf8kIL*bQsxPLju zcZ`5E&BPasXhb6y(wCou967|op!PI;tEwm7$U!^o|8AastlM)O@Os_k&1BlYY`wLQ9`82%}=Bx*E&F4}K zvc`{M%lKX%9dibxC+%QO8X+IsN;ne_V~Q+%ZPo#g%@um{|N_b2e_0&i{R;dbsG zeqs6K3Nj&{4a)n-#>1o=(Is=PCr;tig`!EPYFDWw=%ItRwOKUR+a)nS|85<@vPjbR z+UvRC(ptFj{#E}(Ly&oa#9MLuszbBO`F1UMt^CD;awk3Ne_ihl6roL@Ow+^I)uTLj zU3`k*>_@YlaegC&y}__vuy=UnKg{SS3#8-uvMw_AgT8Mnxm`^H)IKHZKhUw~qX8i{H(x1(Ts(JhnGcM>3zYgzA14-K0C6vGm(ImmvF`?YFe)s zp|?2J-9bCd5|Hv2M($G-jUY0AwBv^|BHhu-5LCXH+O7Fr-;59e4Q2anBXc9rTqCB4``icr7 zrl{H>@c4~I0}b3k-h)UL*;XFm*tdIciI~Ix*68ymK5jPepD9JBWY1qWF!)VGPrpB? zv`wB#%awiLt)tX!25z$OlBJ@v2n>(?MoyLxoTzBvMR5(4)xO(AQ)tf`eYSKMzrCO4 zQjM{#nFPfH`Kex$<%xI+N$U)r(k z%6ljoYd*6$-3v0^H?7IEsnW7BJa1MsW@Xn}KDBu>04r+TOOn_4|Lf)#yMA%=r{A4I zB-2YA&SAVG?+}W5k(7=pr8BnnCbtz>g9ficCmLkzd4_9ITmVPzJ`vq>DS!XO|P(625Kspmt_!XSD%jI zEv^fOUNFod)B(#|i#GM{+9_{p-_+jS8*s*c2JyLsyYJWcnEJ@{*Be(tYd^?eD}BrGhH-pmSCf( z#uTTkX@SI(cot15PHoSoII{+c{a-ru$a?;a{pb6!RYT_bd!*YkKfc*QH`X}{T1+gK zC~TmV_qw72$HnTe^NB0`+v;vpLEvL6|BJ2dv?9j^W&VYuG`&7~CnqO^cWQ*k*BA|w zf?s~9yJy(l{bJ~4Gznr~>oVLk^E~*2(j;i)T&=H#^O5`zLV?uVaGFMK+^=%&iD;8+6i$0L5dxyLszmV128MeX~g(BBPu?NtW{S-ojwwsGR1{-LyY9T*Y6 zPn;+G)&1tc%5(WJL$dAjLpcXF9EnV3&wLT0m|A;b*o338H7-b}u2u)8xl`-b@KYQ+ zit-^rfXZ8U)dBPXnCO)22g-k|;RVXV?%tA*mmp9HtRnX+CGGSMeG~-=dPtr?E{`I` z+@13qv|#E`v;HcEe=PVCdZuGASN28Au7zB+H)gxfhYREI4I+#ovX z^pqx4f=$kfii_j2nG*{(oX%nwn;es%2)D>WGIQN<*OrO$(4(x14Xw+@h6(dUIUOhA z60mC%hPozu3R(d*6v$g@>+H;sof5|`N1bdd7>=Cy+eB1>R2h{mf)yc)GL`<&g&;{E zR^$4lkCO$)4DE{(`t=gRkvm<^o9>yfiiD?_zRLSpY0K;s%^X? zIuSMofYU9b{v8?cZuNaNe?Dz_cETx4Il0&AsB8I-5E2g=ILh&OkHvvv66fItNcsZ` zulKZYD>BSceM!JHiaeah(y@Zb_hM%(+%?pzs4zs@#1beUVhX@}Pm4s7*d@oz?mqMBg(K?>W^trhcjP`#ko%7oDLYptOHEaR`ykIaiF ztSNXPZQirZ6yq2pX!Hp0-%ZM&FmopPwmEWb???b?b9~Hwmpj2n$e^05m2QeFNu{jUbh;XX&M2maN(Q}te!3dESQ`(oQ2j-O*u<$JmRi3v#4tlP)R+3C)_ zrAVzgTv0V%f6c4hQkXx(3vA%S%OCrjCA$+_v^aoE)@dj328)Ba<9k*iyIura91vRzX^@UP>t(ViBVjjC^}8|y3&S%2-b}34$mjeseFL$Y2S+}!W>?)s}V%;h0s?foLs(~W;}CFFEWhS=43MX6K?Rv+^YLNc!-djn@@9eXNHxS4LCxzkwTov3a*3gd&7 zl`?v1P9_sS0$ww%@0t*~Ig}3%aSh1R5vScc9hWG*-00n^x{N$X1obLw3VQ?8cY|0e zq$m^K)2DbF=arFHAcrrk42vCrQ6%0;IMvx?Uy#QMw&*q2zJ$WiaQ#sGFNDcrmJ>tk zyic%&wPkPT$uI>k&1R9a89%TwzQcQ3+Mh3#Zq@B^YUnM3_nADu{)gjU7z9qJNbn0O zJDQ+HH2B;n#Y_?7kEyDA~H#Wk6|hJ#Hcy4pjN{~FMv z+fkge7yQeR!^L_P9)()8s%%#`TfNV7c;$$e{VDOIy={A9RNV8o<@!Nrn!;jpx~0=( zLFi-3vr_dzRsEU`@(64-5WYGc0z-~kPNQPP?TS(OjEjw(9Kp_<9yVLR4GPvGpsacc zH1H%EjF!1+3?>R0WIzJMHq`Z|(2iWj@*ATmje%W|3kLt%h_0%N8ho1&DRkEeV*UWN zaxrdih^GIJ>ggx==$ACR^hb>I@qB_KCbKBSvk$I|!_|?S=SJ*FYNZd3n@tW*dE$!A ztuo(si*9~bN$Hsm&axocs5Y|6Yk4_$(28Q5T>dI9@UIXyb?=`0hxr@@yZc$jRoAS-cV_faONC z+uf*JD^FNat0P=G2yI-vdor&ijUBvmtnKi(MsP?PG1x`H|zLJOFM!z~e~kW_-YNV{QmTLWB@xdVW+ks{LY2ji@_uA% zIcA^Sk)OjI{PV`s3-81vEiWm?7|0$pLiN@J8Yms5Va4?td!(r_DFPRmT1ZDcwpAu0 z(nUeQ@?oz|%;0lj^|*{%R8Et-bZ~MMuFXIZ^W%VZG~VD4^5~;6KUQKTW6t~l8;_wb z`Pw_i(kHM9tS&FAplzZ7TD2^(;Mf;Vo-M)m)Vw-fK^k${6c2??-g2yebxNjT%p+&! z?B-ymAyyZ)q4xb6b8IV}TJCa4>}#BrB5Qy{@Y7mjfwh45USB8;J4&sb;~QprG?^R0^RG3)#B0Y;hMHiK~3vE96)tDxTQQKD#J|Hxn=VF_`vCaFo3EaPDZx={YBYH#2T)a`Hh8y!GW>#0UzgL3R z2qjpXl(Hxd662RE{f+JGP|ec3C1;&1tM3?xS%}<9(~_NX2F_$!%l>GWO6>WMz|Tqf zs0C`;K?poaE^NJKbUwE(`X974L;HoP)nErNMP}HVpGqBe{mM2qKF8uX77K$)r!O{# z`xY^L9?VZq3gTT1$K0?LhMza9NqRtFlK@A?QETVwbu&|V8auJdM;ai?McYHCr)BX=`NL>DD#7mrDP}Aw@w$i|D;dHHaH#)u4AW61zKEEAyn!d&ar$cBSN@*I~|% zpPa9%9!O&*a*2iZa`qo~ZU41N)pqnw8ZQQ?)_^A7D)|&%>>ySsL=iAFga3`e)$j1aQ5kUYou>~oFDgxp zZMcRBtFiSXzN|dx_`|J&seSDj{mCAKU0ZVvxWp(g6WQIg>~O4K?Ga4yxcwRu@o7(D zz*B39Hk$coLWS2tWGNxY@xDa|AdKt%SvOK&J@8(w-2*#4r(3EmS3jB}L^7*KMT24< zDAVGVFf9k))Vx;IjvxB+tp{;_ZhwH@s3@%K)1n3QTj8PjA7(T0xK{b*9EsXZ4DvY0 zJtkO0{xY6-p5khfe(xG)2z+eP5@G_`5axqwnQnC}G&h^)3dpQ_pS_REwY%q~8K$`W zKvRs?(#r;W6)D*Zo?@%2mir5BZ+>icf|hsY(h;w%w!JgvIMeN{-eljA_a2v)qOexB zIbRBWQV3$yO0n29SCNF2kPyJE-{c))N*JdEIKYGqRO?JVGAbiE?K!A2QDCY+%SRaB z7oY6G1aaZMj+}Tv-*5RgT&Tv*brw25?Q`@#u^JqX3wUN`7Z=m!QD!~)J#H)Fn&{U% z;#fnj7)?%}uRdsh$sXn0Bc3#ZU^v7_FL8OW?^<3C4 zWgeI44YuRU>a*i1H{Rpm3b?Ai3tJo$*=+8w$`@&luMuc6U2f6J$0XI?oGp_tnIgp3vpMzXR zr9vo}Mx*nv{}P@M2@i3mTo>j3kgwHygtmes!8;AqeR5`*ye|lVW!}eqz#dMav?_<0 zi;^x_BW70K-?L9iUC2g7G~mL29-@pz_PjAhfk(o;S{o#82ZYL9& zaX3}Wvo0B-0(oTw&6n*lyia~U9F#iX(!cqcqz9^yA6;pi)GvDvDkwumV@_1lX-^z0 z=wuRoa}gk>k+Yu9$G}=sQyZP6!_rEnh8~X=Q}HWC~Og z@nmEw{`D-nVfPUmZ8)}@`Opo=$ZiMR4p+NrJT^(adp>{Ayto)^lGYdXuDouAgV%+fGN{55hmM@oqWbFZ3qH*E!C9y&Vc7 z-6{*Al*&+DAV!v;q#_(g^9(u%;JWQ2=)8R5+|HnO<*X=7mt{)sCncmm2!6a;1Bx8uYctdPcVY>_W`q#~;XgG(BNjo1 zI9H#Fij2HkrQe1IPL6GE^Q7AxZ%&P8@}iE`L~@S3UTJ1Bd&x$WZ2_I!trwTer6xS# z5-56^H07Doo#Jos>P3T!Idv0#7_o_o8nUh&sUVYkJ|REISCvY0{GzOBYX>w z{Hg5L#Q=rb401|Uh%KecK=6^{@5HnJ)7y7PHMMQ)qo}9|3J6G7s+52j2m%2V=~bk6 zrG*keTIj_>Z--t&KtMpGClH!|QbbBX2rZ#^kX{TR?FBvep8MWA?~dR2jW^!@E7^6f zxz^fyerwM8&77I4?mCpmL{0wm%Nx@B9}LlHN!h$fyE3gMfU&ZDCk&Nauz=}sZ zHnwoM6ij0M#s>_o~Ysl;e z>kLhvh>B{D5m|nIe?w5eu@1Pr=4Z1S?Xk_TRb3>DPDy|kHxnFKI^Ki^-_;COW zALvH3Nh2Vq;X6;D$wfF9#a`rkap$!K_)jCk?Cafv z!1q~Z4aPLFQRJo#ojg_GhfEz)O2Unj((GBzI-1NFpS)%#Oxm^DT{2!=cIH8a5pf*m zbo6^_I%0wz96gL;etOEK8dHWZ>3Fr0(4W+RuMc&jqms7>9#ou;_K*MRh*f1kxkJtzu?-{7ftS!Y*jorD>*&HM;R`GN7-3#M=C45ANbV`&ZC@$5C*gk}j{Ao-*kt+Xdrew)l%x#`K1RG;jLB~mbt3G2z1 zD(>r(4}C;;yAuu5x@I>04+MTX-6-*+v3T(+=sqc$jOg=vW_+8W0pmmS`7^_E%5}5- zA9SBkpUQoIa8M|4%a=xlarCN{$rN-+`+KJo_#m*{!nga8we%hitR%&MxzSqOR2&+E zvgC;sX^GoNXd3J5kMu_89CQx?rLGef3BM~$1=v?LL z?=|-l$F?P%E17GBqdCOA42h}!#BGvdbe^m7W^iM&3=4-6$WH@5T8xmEJ3j8uBW5=n zUaj?D`|aHG(}z|IU9i2H8GaS$k|FiZUGy8Lh`7~1)&hzi%U-<``B@$vhv8rR&-sz=EfFjg`2Fwa3r2CGWutTId|%&y>&>ys0=?W_Yg4{f;FqVz9$ z04L{`@6Kl(N{wZ+>=J2*PHonr;oHHtS|@(V?8S&)UWAK)nOppwzEcN7lTOUCY$(DZ z&I!<}0E;r8rwL7AmuJ)Q^Pmt`3kn8l8IQcL4`{3gi6vuTuxaIpov!U-)Xv! zmRC9->3)2ne)$e@RaKI>CN$nw>a!L`VgAufG`=+_$;bV7e{8x#M=8!3#RND0LCe4z zyWV@HiILXk{sTr@K{A&hW#I@ij*%vKUFtcxT&#oKQ}hfxCG|nFwU5#(f?tFxH1et>yzz4EJ*%j{M562`aD}4cH&E7rnv75Wx&< znI1UVEwMI#rE!D2dHP29;SW82<#3;(urh@TbT@O(o8t3V^S*6gS2Bi%G(e0=?cQZKyLGd@=`i-(FAls-S)_Vfnyq_HG&HLGSt|dpP$l?G z#HU-9ao22i*Nr%w@{->@NHW|~R43-_ctbBs1#EXgDGPqZY1vj0*#Ap5Ek&HbpNwnw zM}*u@BP5&9aGT?M#SlQ1VdcX*bXn#CXWi0vq(Psu~a}S2#UB$R2 zEr%ow%F4)D6nW+OZA<2rZ~oru{EX^O_QIlu4c(>Tvyl%HThbXEQT0D&F?D2SoMdMs z;gjBoU>xw(Q5j$0)`tUB#B1SczovVYUxx$iBAe;O`YI@YBxtmJm{pAQvVVG&+pv+k zJy-Up$J{D@j-DMIrZzscXEWrT&|bJqq5$^D;+7ELx7t3`|PB^Su~g zWb^1~#(@q5^rLKW7R&UxT^uv=dtxM#jY1{Ap%yd)UIqG+njx?Mk_@(>NVYY3G>)PN z|KahQdGKF}_5OAu|ASrbFGu;`ruxbE-*N2yziQzxw!;4vrT(wn zE^Mjxk$}e!0K!8fRG#hzCVysnvwIUNpdL3jv7=Yr`wEGDE#~}1B%l~IUo!F2{@sO* zv5%~}+l!-PKgvXhy&dV&Zku*-&+fF)U{Qv3tE|ZCMsM?mQR@j=EoAIsfwN|>%uput zRH?&i@t&6>@?nx3A5~=gdT+PFK8u{E+eXEu(N5Wd5GTs0eA_f0Wc3~^aRr!-23Q>^ zNu{sK!X<7TFkrkP*V!T|Rz{l{ETuNiM27$PMlfppDAdq~RA+wqsH2gQ{18sJ(&W8( z((guPtlImMbuk_~gk0X01%oA|n1Dj)As_CX>a|aB4?5I~gh0>3&$D@hOGt&Rb< znJBJ}rCEvb5d0g+2qS$n-D{I-?-~$fF~qnmRxXc?g-;0Ap|hbxGUdJbksXq=QZ?~f zFHcoIuhdsicPf%$dsZyT9phH#M8k0Ruyl%Zv-lAAV> z&h+&c2a$|%*6`}a9Udt_mFpHe#o+|BXeX@`DqM6M$MC+)txS*3C{?hSU~GZVwqIDW;9OK*xLgX=U6nD20@~D8hBX&uB|neI%|I%!9d3vzv>a{ zgZIlRD#{ath6F=17ly&BHy8t7EOvDm#9VosE+w;6T!w(; z=|MXGP4&d3&il3%qtzSTcbVu^V25ChfR8z0NT>_yd=Dl?B03)ep+Ptb!d~@)dO37+ zq@K*qafM?-$no9SRqEPnPj4h-)%!^guUbK^Yj^i|H!eZqTm7e=dFDn5B>#9*f|&<$ z@zNCL$X5;?WVD2j;6G)y4Ub4LH6_UMXP$mWOiE7$pj%35{f|^ zL5tMl35YT;uWltx@U3+9n>tjwtnITMv@X1=Z%g*t$tX8ZCHx1wuIjFpZf(a~zs64c z&1k4&u7?tn(;(5kUrubce%AOrR&n>@wwZXvor|5lBKRUBlTrKNn>>)xW=n*C7Oftr zVFp(f6c+7fFRd?&{~`1xmN2+++nVh|TxgxGAIw6eht#r>=VgWNH!A_=Aul9>R_uDX zG9g`p)wL_6#Rc^q{0BNRH8?B7+^VVE*UTk(sH4@Qhz{fM1#6#{<05R_PU`Ig{Yene zHydQl^7MEXi_CDM!@-#xnArtH&)#=ID)Y5+Jz*KW{lrkT-MYB@pDo;yB+QYi^EtS7 zO}$h*+)Z*I&WaPCioPu%Z8h;&86bE?`U4l1(Y156O!p|ZbF39{ZUEg2nKW%bakzK= zdY~v67ARkldQw3Ti~{Lxw{vx>LDwZ%({l=^{GcHCl6&n1eN%*EK+YVEjpd$Y=Q^Wz zO7HCDP=Kh-R{%>x*1ax12`2x1gGh`_l$|89Q6GRF7Z{?Aoljfp@8NIP zqkC-Jonv3BZ5S}*=zBvwS@7M`cACor0BaOPmy1qKq%I?;y2q3SVOn7umH!%xie3-- zvQT&Vmnrj>-COVgz(pIi^(|`3DWGJ+(BP%U9E%{ZqDEK*p~Sg=9lce5CPb<-4vzqscpEvxDl6gozo(C4?Lx_}HneP*{R zz0D(Y^cnuc2BrgR_>Kk$(VM%$W<8sjy~;mnpavU;ruZ7}JQU!Ji(6VgoVb2ExAd}9 zRx9lSr-OE{M%t-AdoFU5twuO? ztTmHF^kk}tVKL69VAV;S@Y+WH(M2hFZSz=l_!iGkFPO#1`1m}vr|9lc><^>lhy#t_F(FcumNOb%+(^cFM~xl!$nb#(Xjbh4RP#hkgejv&EZv~WQhQ8yRv266 zE{y0AGPJbQ<*Cmq$;Tbsrsk*Z>wo(BMNSotSe+!#rQ(G&Kv`h@%aODu7yQXK`ZirX zrnysV5!PM6R(4;0=JSi1g=mRL?C`BrmJE}G(PGyFnDO?oY61Ch0t?9Sc8|WnGiUY+ zu&Z($b!NbgtxE6bgTFG`b+~(%r63}bfjc%9=n89dL_2T9AV{nCO96!SO_F*e{81Xb z=6J`+>ukxY>ir zQdYY4Q?~Z})p!>4X!)gNM2tO)Ct`kg@56Eo`Zswt2}#m9tLk5S|DMbE|J2T!>g!|p zZ5EQ~TspHCe+w4WN%D_y(tlxD{y&v0?CeA3Mfvf^5L=eSk61h&@42@9cCDvb*4=$~ zV)A57=wy9E&~dpnrBme-XsXcEU-cQ0G2-lHk;!|yK6$)R{JO#KK+MuIw_@Zxe!XVA z9zVKwwBO$DR=a9`GJjgzfieT}pBoJ-aQjhm{)|jvilIeBQGo8S_w)d=G(S5Vdn)fy zbu4tceLAxFH3dg}%(I=+lbfH?i57DZ%Eai8IvQ8QH4-H9!KoMpZ z>*Gu~RDtEO<)^bJ0ZUKZe?becBtKjY`Rm5}Zah(1@Ku7C?(>fUT!&5#XWg*w^U{diCmj=pt0(8Jl45KJRRx5p3T@^V&i zT)kEUz@nC$N$>GjReAWV(xpegfzU@b`IUHPiGjTi9`OYl=&CPj8ntG>l-v{bwJSn` z@h?HV;M}_JD;dblnDMMzOcC=KIp)kS!|DEJHac9il$w)iG2Fa-4ukRXco6}a{ak-S zEg7#qqSxWkYUg818lWA}Ko@&t^t#=l`toJo@U#`rd@VQ4EcpCMo#vqM^35iHw@vA- zO0j{#T7(9bHBFx{jU~+$M{P0m0Q0(|-bPxVWbMM{XASe2i88VlJ5C>CpX)eQ6V_`G z1V&~ZrcOCViI)rZqhH99@3O^?_v&3?aYlVTO8Ugp zgfLDfmPR0*wwxyg4VkY5_O<6#(h`HUEnQ8uBbWfdJN>$7wMYIXr#8`K7Ri1rG*Z*7 zNt`VgIlOlB^6*u}_~Ch6TJ~rQl{{fctZ8UG#Ay;fZhwBQ{>_6iQ9&+=43(ljXg$%A zlktM8e5gzAG4mu$Aed$iM>C}yF)-m6F9P6}w%Jw<3$XC$`2-^m%Iyusx~q2)HBNt) znURTEg~PKYa{|5a_0wi?Ghg8j1_W`nS>09x^GkZx%atOO#fy@8sXJA_WY+B?D0UoP zEnTabtqyfQ^29VkdNU`I2WBNv$~aV6TdwBh;SWERlr^)I;->)E2CRt)*m%Ul8MA7| z(+sRGmN~EEu^AtwK-Fn=dQam7?A#4GxqDWfQo=64N4Y|=>1}H_>2nL`1tUwKdzgP!P-iX=7BSMCWBtAhh7DgtY01`*MrgjHW{=8s^yuJHBY zx_Wc@>64eER5Q!pp@)yEkFHnqEDoisJw&t5qvCPo?6fVr)v{)_?Bza zI;JlqP=X3K#XhvMUBi5dR{_ywUa^r+G38crAKV|qAAK6>HZjsd6&fleQ`mT%6Bh<= zJ>!nUSknNp*ynRTZPt&3ZnWwdTdFErDyyI>yt%c{!+`i_E)6qu^!Yp?mdhp*5@0Hu zrw^wBzs2uVRF-i6VO}R#e_jK5FKg=YiG*GrzPWqOOCZT6AD-r~1~rTPnj`EXO&_67 z&{SaKHxi_UXQV;05lB6NF{fZ{LZKYE;Yzj~_OtR%=kiiR+Jh=_oZAg{V}oUy@XGx8 z{;f3Jfk9zdYWn5a9tBIoU>3JPR|z$fbB7DbgW52cwi$P$RAap3T~hL zUZZ;=Geh4oGiXgdOy$uW@w@nT=C0&YxRbe?{_A$fgq_^_`$F_&k{@i6EN(qibx`_4 z{+u0%sjIy$fnOoe;`!Io#*O20XB>dufaFTUy=~HIXZ2X+8En1 zXXu!A%PX^s;WTj_3$j1~ad^LjiKKuqj*EM75i;Hrgth3XV-}G@OvpJU(h9?6qCTjA z%%PPFU{mEb@`XDfc-surd&Ra3*;G(O>^4KA`*DB=waI2m*dY1jCqp(=KXfWO^_%f@LxLZ#!oNC`JSXTv4EDi=8#`ew#?O zYp2}lMmk|-sA|u)+w~UD%pkji2QMB39xrUBgBK#>)u~LSCj}!Nhd<{^sWzbw#;{vq z2e}$qsTMd*UhakTan^RyHoe&a8cQm!zzO0&&3kiyP&KJALpOZf6s-hTC|K&ac(*@N zQ^W;wdwFZ$M8nx~F>|5y+nQu

9EE72xovNny4xDJtBZQG9O?CedNTZ=~Lq@c#3n z`xUTGve9jo$gcSweDG?&M0p9lFF>a+i@9yaV=n-B%dFuThTZt~wsKWQ4cl~CgYwKC z3A*~qhGU0!&feCui~kVPj1|*JHnONyrMrT?8^;3j&XqP%MJA?U<_(0)wL}qm@({#v zu)lSpZD1Rq9kSu?eF&RwnkFM}9bAepOg4RoOzWS&fm`s|&IF`q#Bu}H^~W+5c%m^p z-4ry&)qM2d-s7#!(=G`*40=TFM)&o*O_Q0A*YAuny*B4ZORzHMnp_qfe`)X$Mh!81 zn4DqV%Y)C@rd!uIKmz+#id?h_q^gwp?;93$t25LSRqUVsj2<3zhzu`&wpXLNIAUmR zc$ERthwf59f{oO$h8GPpVq`1B%dZu`%fqIZTA@DJn%gVK2XpCGamLP-h-h8>Wl6q` ze|Fx&^}e-t)!`J}Hy!Q(u5!|Jb6bq1T)kpon@mv(N*T3i6s^q9_MY8K?Vnp!do!?$ z9vsG7by$>H8ib{%GDJtdM5AHVB@s6|7Mz^km!Ur1Bb80UE+$|$2&>v0sR>a@>N0*e2FEe}m`oO=fwiaD z@bKylEyJQxZB7g4^;K~b=ag^QhfvWq3hBmcF}T(qWb)lE){sbA_41L3qI$2Gdi+}P zLN8=XbfCViL`MYk3zuI+umhwe4-HC}?FqF2WD9mg+gY`@ z2U%__D9qGtly1zp0!2n|7!nMh0u#VpwViTFWWRFT_{ae+kWHJ96?sLa*~9ID+3zg( z*fvw{zsI(azAGu(^Of=g^g{1_hmI{-h%hyZhY_koSS3c9WhHzh#@NVF6?U%s=!voZ z3GcV6oGKuMMtexh?!~n7u6jQwUMU(gsyZ!$*0{=4Au#;b$%m2>)ZSMI=m=%6TEPm7 zs$!qJm-IMpMyF+mJa~@7|D#9If`w%h6LC?(ySL(!)6hw?)h)nPWBgxWS-~32m02a@@fmJr+wwR z@=+ZR5*!W|b=jwD@(w;-A@4`I5KIyl`0p8%oa{-yE66**Y^)JE@Lb9QxwF%)*&2aS zcq2+?+k57D!v2`C=$C3z)njtBdwdj7)Y?Ph7x@!#W~ik8aBo9iNQ{Z`T=50y^~?mG z$3`^7WB-|Z?!O`n5@Nlg|H%VD#6``r18Wn(W)`qDJZ-eXu*@amtw}+%e*veZr3L~) zYKhCHH#5d}Phsf4pAmRmwitLcJG;cSu)lRW-E=bC^so5p*TXZpnhr2!M9A09c1phc zbeo9nP6_)iGu!i%#epNLPF&BJ%9Zs4B`zrAJH^n%CIv~B!sze9Ha vPXGU(w>y;~UU+&cw2+J;{Yk9uj4F4Y^X;XRrPP^zu(f literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/09-vm-mode.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/09-vm-mode.png new file mode 100644 index 0000000000000000000000000000000000000000..52873ae3c4a01628cd53823aa3c55bc8fca3dffe GIT binary patch literal 48688 zcmdSBXH=8TyFRL~1q+H56a=J83rg=;s8XULy{YsXdJ81_O79(kK$I$kfb`ASdY+7;F-XU?3trlqO+ z=FFLMl4s8R<8tYr)0+H7kLzd7+&H79`s}SgY?FG~oNWayMpJP}PiW(QW^?{aze|V6 z#oJ5+fpwRogz?La;^}#-0D%HXrlh#p_QG z-+z96{_kj)`#l#+afwEl}XRFc6r1F=Pr4Ks#<8|WyVMOK1c~_0ojJO!HzHfQK=URSo#d5dD~kbwbuqu(T>;H_M|#Br2A2oP2saD zN9`}jbMKQtH2rJAhpWx$Wl}vy+XLE!fH`V*&0M_Xb`X6KIBS`kG5Rl8RDf`AjLrfH z6WknZ^|QXxCda8|>cQpl>r&g~+^P1Efj1OQrqN2X z9ZRCEn?DUhZ(J)mS^VNYn9t4SHNieeKZJ8Ib{1#gvy(&uS|#YzF@2eIUV$)`Tgm30 zqq@#}_H_XW@8XN3@o&#S5ql)R2Upt*S^3k1(bD?q0bOiYvL{Zr#5+Lfy|E(kLVi`f z4DPLzUEpa zyK&NIJ{Xi8=TRFmG97l7A1qT>%GQ2+n=Rr1wGyAc7b=hb%S)Hx-$o(M(Vf|~we8Z| z&f8p(^9ZoZ2|-mgH^3JKu(D|xU*8k=TJMVIeytFhyB*+R$31u3Jh&=!xIEASTO)Xq zmCdO_UW`7t?5DWb7tA;LrGQD!R=`4D6L-i=)%5sSlD<~hAX^NbwEx9)Zpt8zELlNPoodz?8V zYxaw)N-O2ZLp`V33pO6b_uIy#^4XN$M@wG4awS@Sr9b+5!$t7ns7x*6g^0I)6YI7Y z>qPS-M|;|0kinfaU$2i51|9Rcn`&XI$Z@~E-;Jo|nZ=b(uCaV1K&%hf8-_%0&5rAM z9%U=>i?P>KxVvfvdRBjFZbsQbd#fA54SyIKsWX{G@B>V_b~6q~f7jKYQ_X+b4``I^ zl@-g($q3Fy)e&xqS;EUwlY1D}1p5Pb`q{IS_FG1D7EWYsyL?I;iXnb*@Vfk20> zR!`$pL*@4_25FlHOOs>lW~=7I?Qh;Rb6b@2wRSc#K}_%~e^y=WK<23(<0nG8l1f!_ zf$McrnSzC6C0`Pg2~CuZ6+CS&uwVr1jb_= zV!|F%@T#I&$%`|ycf9CJpRdNYzJ8sL2NWefM_$T!AkHe-;FT0V`gDbiLm$B zLL;iaVFUC%W2C(t?f3=t3~%(#>5*Id`jYx=T(!hiA_^d&B86`@OCvj=0VFhN8y!p) z3D_;rHliNHiR6l!pu7|1Kw*B#cran{vcO`wMQS(w5B_)r2!~)Y#3nN3*}B#)=^j1P z(ZiZR9-OK_^GA}u-J$`yk*O15^ZK`*rx`}uiNGS;Z($s*46;)l#IN+ErQ4bMRuio@ z+J`S^(tv*3YqnAsdWF)8m>|EERoilh-t`tS96o;e!o+cIJv7d5U8MA_pJTwYmRD2- zu*2z25y{LA5WTZaKPbRQSa)d5s8vb1xEwhIC$+87{hOn3f_N zR+3c+dHKmWh?t;syOV#!HeRa3xW3dg2aJmY#w7&^r=?olCStJfz6m_8;0AD2A5+DS zo1#)i?_Sl`tu1#w%WbnjoKU7XTUwImT2U*K8HrwZ2evJG3kBjx2^{MSL()Li*0ggu$nA+H!DqUr9SLZRTU#te;2 zILd7ec*or*F%(owY93v)EKCSJnfxYfCF+m7LdM_p2Ug7kK~{c>Mdh zKFc6}N-#y?n8!x#f*g0Cg6E^JNU#0g<8*@iYA4zYWw zaa0tg&-)$d7^3gQN55wNUK7Y$NJRy@>{l{>8vQT<`^S; z+e5-}{JajfA^eX6o~!d(J^_T=7y6Ow^m^X2F6T>!{=RfzkR+5WovS-e~G=9xlXMajjo4Dfo^Y`NiBb?CB zB>Y`wW&weL=s5Gx&DA3M3ezSR|IgTt>v74N1t;*wZ|_A#GcVuY-%WfUZqo22qTq_h zqsP84j3aDKav8&gQn{6VMn9W$7PWDtzU0ZvxwXKCW(25KeKFSR)Y%ADn3C#^HdLvH z`F`;wlukfxJYh*A;^R>+c~A8251ji3DRwZo>K6=$E$@q_mb8`jDonoZQ0R-u%WFLp z4XOX=xA}mT@n*(;%i85Dq5tw!cir((=16z1ozuA^<+*43>4Fwlg>iM^7jv)nq?~~c zAXD26x+gcuOT1h2;iKG7eVjMizaKStlGQ3ohNB;4nU7qE`e?2mR4RK9X5jAYv+Y_t zodNsWC8G6>T+`4{g;iUa^vOs(7FNjGIChNkJRmsx&ZOk>Juy-~I?|<{7}(|+#q6$? z6@_QaS+F+UDh04Y?x<$LU|;zRjTQmtdUXXat5)pKSt&0CZpWKtE%D(jGp5P2U@)>u z(+Pqdpw!pcI&U*$PjD#2@;!WenWl(nukYqW#T4_ag3@~D08iOFBh&s!)z9P$MQ^!La}I$C0IARmKCVqt=C#>g=9s2x zikE|zksBS#TOi0n11=LeHgJE|=VqFu%wckYi7INdc<{QC+6fp=8<-)Wk47d>?8|hx zCfofK=_K~SJx+H6s*Uh9`zlA76)73WzS=?vu1N_VJSjo3#+Rv}mB@D?IDk>{m=B>f3BD5QcPTm!_aMjtO`nM3?7bkuM zbPZlt5TQMl7NsR5;09lQs2S$I+8c^}(=`LCk~>jNOGsl8$R_pDf4|UsFy(R9?D!!{ zTG#;OR+lusDZ=jM!inbub16GLg!QG>RR30WyX4@=HMcPs68z%l6Vz&imZHj&M>i8g z1!v*ttPh@DP!DTD*Cpgw)Z5CTlk+6xOdy&+q0rt}(pfC>z4k~L4_r#<9Dm~cT3y%c z^ezQOluEKH)+AWKr04JeMcGhrO!?6AItpWs*HVzu0KvUwFr=S;@&xKc;Z(XEaje)q#IXz%ObX0;Myg*p24FIu3(`>yLA`II-%u+$5}y<;k0ry8-z|BVF{Sm?CIaZP%82F}HF zeTWt|v?ta%C4EJJ%~HFyWeZW*O3Dbz4R95YoT#E3_e@H$0S=C*-Ri7mA6p1rx^|!^ z#k+D(rBh{?5NSD9js4ogGl16NCY-CX(GVDH(+kjcJX zi=5|#Ev~M1%v7XMt6YG;aB(pOLOlq#af7)o^~pUrm_}WBeJ5Zs(2$F*K@qQp5-<4h z!AJX|#Yj)+3kI-3XPAR|6=`aTt#=cbE*EG2qYHgj=V25{k0;~onV)s3I=9)j{N(7*ON?yWlcab;X?@!oZI{}E5)@mhW`ja=K+pzdQ*X6%N6ZnpbRcoG%FPR_o5R_Uj; zyhEqD%x3=k?OHVZm9?&(>D$5SJk`>&+;YBm218C`dXUWP{iczrm;1M9IYYnFJ|DA% zxx1bCDonZc-{#@wF}lOR*_3IK$rhu3+f*e_DeJ>c^5WCY%uv08pcZ7&emYn2qNw(? z7^ijE=J(Ulo;ee9OS@oYeL3AM^-t3)UN((hf&!;sJ(hkiMej&igzk5+>6(U!sGJdAuDZ6}IBr6wWzqsSf! zLmQOPwzlIaAunx!z|FI|13Vehpi$jAkZ~%|mcJ+C7j0l*d70u0YNlv?4rN!#=l5#; z96#-4t7YdIl~$(GF#+@$!x5$_GywyPm73wx3C62?-5KE5Y9Nvfpwq`Wf=U0_WbEV4 z|FaU=SHC{DV&(7PI3Jn57}-tU$5#r28V_@1IF9GAaBnrkSblmAo_45@=m^yg(DCG_ z*14~h1UXY@%b5RSi9gNdRpw%NOB>gE`hb>K;geE)GBeF@p8;N$7Lchjv#YC&I8xk+VUOr38wkI{HGnj!1txU5Ok`i2sLPepR!(Lf< zL|vu8;Ag}fb%k}7lZ_q=wXBg$1c_j+4m#=n&A+53=ZeMsRF4YvLU%sXCsGFMn#iM_mOL^_{-W8<|JGA75vQ2On$e*N*;_;V zgWt5*Rsnf#LMI{-J5g=yz_M6Wjy_ti)sr3x6Xp!?A9WDl2qNG){V8Zo94~dV5Kkk| z-nsxE+zvj8bEQ){FD9A8;14*GilL-!l$D#@aHJrPEjjXn?Wv~tC?|6`*XQ}QClw>4 zp9o!I*S12GCt(5ocPNzz8Yh*UzS7%yt+?MDe4LHrhxAU7I z+)F%Eq3tFwu*6mrmZ&uE&z4|jyP@Ve7+=R_#I^pI)NkbIfl|f29=7sQ=vMNujt(|+ z^taaOk$AV=Po2rsq1VbFj#%FkOQwvL(x?6P^S5gbs3qN@_l#C*W#~W1-E^NRsnjL4 z=pLLo{U;VmV8SE^Y_S{h1ABB;0i2~!!UQM%h=m|^+$#3yrF3b}@15joNhoo>7jrZ> zgR}CQ$jv3*#Z8k4px@!)!vGYObnBXxOe1klH?KR!nAB89764)>Oxn+*eCK&%5FAiD z$&3R7^a%!JtRK+IWHsS@8MyI{MH;D_mRMyX9+IIe__Ayje@wxu&<^|I-l~?G#xD`U zL3v+jXi)P>xB&EMhHWh6?%h;m!yF3O%yOT9x99Z873~QE2YMfD71~fXvW^9G21gs} zy!NFT)jTaL4LiKIsrky{5x%?VK@8PrV>m3>3Qg~{Qm+4|3N@_y%av65a5PHY@0|rI zuVL2X7QYl6DgtnTp4_!JquI69XlO%3Ma4sJUNRNy(0W`Q`vzoMCWvhNNOb z*=0X(66O%g;K1}S5!YMZM7rOs#}Dkv{}$@oVR9HuRBj;l)cCp7hm#J6pA6TjM+3X7 z8D6P>xs?gxMk<^TnJ|Zn_|IfZ0~}n%f0^h(7U6=nmUO);D@lh#1cOF{aM5CS%S{78 zhDU(#0x^TwnWe|}UzSx)c0R4JPOD-we$4d<9GT`x%kezZYrHpBeTY8nu92|}7z_j7 z=H4r2zXl^NCfOjHJ|%LB0mK2g{6}4JV6Czx1{YeDx;-84t+?bYb$I z`tug!CkT2niwvfru2)xEpRc^wmHY7)kkkY# zMfqz1o_1Qq5Op(o1s+_}P24QJv^yJ~_=JYf&2?@$G|efz{a%}GJ7N(uCek3eR}B~C zPR5quyW$52G0)*gJT1ZS2iK=Zdt1cC60I0PZM!0qz~#AUrMC zZJ)9zOh8+k(GBfJTY)nf0hDBU55Clv*+4(Ue)LX*WsPtr;oNpWB|tM(>x zxgWiPED0vxGlHrhFA{IRtarjn#0zZNM1h(Xda%%#d%g7{c|1`jfyeC53izr;{Bd7v zw7?kgOBqtEx%%5;#tv3e97Msuk&S-yUIUs(j_iZzn~=V6X|GZCth5LOWk13i!|LLRIQN@67m8A+E&8^*hd!lo2f9^l(W)m%uIJnVOgI z4C5;=bKF}CQM9EZD+^XgihAEjIBjDiyaU*21sn)Tl`h{K0Jj!P1dIj)k@L{6?bXuBSOa+}BdCcA`%)20{gA zbG6?*+%~G)JaBZ;xbFdEA>It-{_B*?{rTYb0H?CO4qVx{b!O1bmBXfmsj@t9L7+}) z=L7YAiqrJLAfB4diKz$|+j~4PK#8}a&0!Q9d`7GrzX0SLrfAgIl2+z0yUcTDR@6fj zd{%z)lV8(DV$EjIvV!wAtzFf|%%($*2%ybt@d@`` z$^!lNnCLjH!RN(l6JKSjSe+8pqpBS!kyhX}2nIqAw~G*Z+n;T84F>VS?NUr9^RY;9 zrUFAN)`uiRn4rvZLV{kjU(4#C`QCnSI(xi!4oI6zE;*OYOphEyQP%64i3@DBC35g8 z{&YFNc>O1y$WbKxqSM~#*P9I;#B<_z(1*L@e_3u>!hls>;n1p)GOaJxX6l&WIx_`K z+Do?#AQV=Zr{$URsaw6aBA|@c*x3pa^3jgM_Qu+?CG;ggBv9!KB|H4U6Wwg zx>M}+l9?rH3tjfpC4I^f_&n9%ttl_tx=-b80j?-5QIjlyvh?bQ6{pElOtO&I=DJqR zeFRI9I#UgFLiSHiYnA(u^bpXPE=h>`AkJ)6$o`$x`9&9KYn7$p^P)>gp4OZFZje8? zjzFk{M`xs#TvMBH)N%^dQMDg9&;@Cmc8fl+&2o}(j zTHV?pFa-eX1d~~Ca?e*iW}pOzscmq}k*#M?-6WF;um7b@3wr7l$0Yyln2$vw@p`5ZI*G;cq?+1sT zLV#tE>4AsBvk6gcqa-FIpg~R3Q{cg+2QRIw4Da%5AuWzg8MaCvNk2h8LindP7MIKn+?e1q3GF>_u{YW~ zix7T@@?HD0qO;Pl?XFyl2jhYj#lH>cd;PG_3=BwK_>|-Y-y*eCnKxXojz3KuAEo(dhx={|7n9VM*Opa`_}_Dx5>-HL}Q5Q zn_I3wBF1R;l9`Q{iODpF5HP!Gl?_}{a#-$l74lvF>^y{vZ8kQpBND?Im9CaP7X{>4I15g z7dGSD!sJ!lh$$J~3UYE?>l6Qif zHFai^WM?<>Pu-|W+q=de9o_4xc#gr8VcMIyQsT{ryOm#Y;zI^g)&TLll4dHhXUC9O+NUpsh{O{X0TQ zC}S2z3WEaaU{6BWuuV(|&=p~DgHn^vGjeMZX%b{|^3K2-W0s!-Ppf$NMB1=p<@nod zSP1|pSs)g-%P8&VC?>e9UCV4TnS1mnu`uj&oZ#vn}lYL%x&XFMU#0lG?TX?qGfCfTtRy%g!{ zv1*ap=GftIB}9k~0JKS)RR|XQ_C_#kTnKQ{8lKFTZ&#po(TPdYbXCsyTO8lB4!qCL z2inJLC7qNtesddvB-Ku#Mpib`(AsL1u=t2b+1OdbTW}agb{0Qrj9pXBR} zaS*cF%Z;hA_d`X8B~-_hwl|cbzTuD&x^FycEsu}l)XHaEE;F0w8fjV3xL6R6ZLE3@ z{4$VsgDxcs`T(zC7v^+Lu3G^NOw!dTS+(b$>K<;jhfno!)w?>pOXf;jN;Qx~Y2}7T zJayyHcW|GbcN#8=TVpQwHpWueIW2F&O@D|O{Ki4v)oG_Bq@nA7e3X>*_3sj?P5uh* zy8AM}IPv;7>F<|%iy56vFxhQw!p25SuJn{>oZuU=F3mB<8Y8KxY>`C7Xk}#Z$Cw&x z8G+(Heg?K9AJsdN>CDR=;6~CW`#yqEt$~cN>7Oz~e!^PLBz;*t5kDt4X^ve_yyy5* zUpq{X@?BCHk^6LTzmA5+=MCAX*s=(9eG0ZyR*bTp^dEWa^K<=fan+S8QAy?o3mY}C zIs|&<)q>BZvkTW`V=dvcj$NP8|1)Cf=-Jnb#V|3N!Nn(5JakM(6FD z?&vea?;$P)xIyYelk%6sF80yBPRXyPv<=1^#OOv_ zD=pVPYo7c`wqVBaT8d_kGfr}r#FO?pHtXc6rBlj7zX?U<4yr+kdBrtwUY57acJ0@F z9y|uV?zyFPC(8ZVzj;16`j+~w7s469jYqc`S9~TM?{Yoknk!#@`L_NT+!)prgU8~r zQ!6SPvq(V!Rj;2zPqQ-ALmn;NFdXEuppj{@iH!_OHb2)iT!tn;^L1xHt~O?6mL9{o~6E|KxB9ytc|s>Ncog z_5IO5&_2@L{rjSn$0YjG8Z*ehxj@`RmV3l0!Fl=W4TFlX^NG|~U`!~U^_a=~n%2U# z%as|*;xoRf&+8DDrl{PhR0JZ=`CXK`sP^MFVRJM?V5!>}=>Dp#!_uno@SI`z__tb1 z1&r#y5R~xup%P%Q3{&SdGjJw@g=Hh(A=7xIP~}`K+rtNZJkflsHNflxzQ#==8vt`s z*qd&Zrh4%xE&7hPK4ayl=o&oBDa+sxCuIM|XFkYhX!>^Z$LukHd9j+-?(o>~2gca@ zc~3qr$To94F1~v!_4&7m{$?jzQY7vK!nzH6pu{=FaN-#KJLkn*SwW<+HV|y&YYN#V z^4)S9pN0NF+y7MY(w4)}{fj?JtMe{RaYv@PizqP1$x7c)Jk}pdxjiqYXqA!(yMu^J zQ+@u~{%H$5@ElB)E90J;syO9k#5MIy8yUY%i9OxX)nteGse*}3QsJ-rfQ3w_46uDo zJ?~^pOm&RE>*lIfc9o_oR^ZvBMn)niqUhPn2efQZP-kBnt$NM&D<0l*HTkv?IsPyARmYI_6@%p-~C78Nn#e6$cLr<(-jzN zcM6JA)w?nGPlBK1Pmi-0m4|P1Eftb=Q5NKQt4`*9Cafu5D>?b4>RI}(_QB`YoQF>y zIs80G9{$L2-#&uhCsI`r+rpj|lg{pXnT0XN)xR?UX>qN>q`@RwhFR0NyatIzyRI&3 zcW~oivG_R~NTXnh&4|9tssE~noeq)E3VM@km_Nh}04mT})9*BkzLVx$IVpuhW{Mm? z%LVi~PRLz}pUCU#(tO|`4U{h$5eMq$p(ArrYQj#YW7_Wn%&M|szSUQ*GpJoYS(6Fk zNPU!RTZMS+`Rj&8zIAKZV77!MYrhq5N@^Qv6Z8Yyqy99tvE&tyyKW=^%go#EyeVM! zs@=%B>6{^$wB`8n99a6Cs5_l@CSRawMw>_!O2O? z=Be9CI=7Xke`rwo!jL5${-uyzRyHI@_smBxC%r}~+g-=qTV^;K6KyyCkegn@CQpqb zUqpHv!tJ-J72akUy1dc|W9j~V*|gc{EeE_-R%-+|S&b^5$?bWhog?`?l3&`ebwzhz zQ=JxdJH zX5SW1vJH0-eU%@Pox8uZB>}!0wwS*oj$PGH=FQ3ZHGx0u5mPcu{ZjaW>`X8olnE;T z-b3&VP4AG5Hp-8PH|QlNF=^XRb25h6#Smt>szRgtV_eXc;}^Qu6J}iA1ED_HEvF&Q z>=c_nG6Ibje83uu3g)Vr@|QgkOESu)pDb?xSB0xA8me_+k4*Wps2uq`uqt; z9o$#nvr4C^7uQv_S~im zbD#_NtU50@HulZ#xSnOFnZ$7aSx36rT&=t^wjyNnKwl0iP~grYVP`R!97zk;Zu zF;lIx(b5XDKkGVh`l0$@W3g>}dtzsNMH!81@q!V_H-3DabQOTm%tf1qlQ>u95B5Kk za+c5KPUjY+ixsh(E`K^3FBB+k-}&d27nm>~bJAlInR2wn5pSiiumdY9a(*lb-5u?& z4v#KK6*O|+e^dDLmC@)~=xetQ+a;5^Ctyk=D=VdSrfq*;@HJn-GN7w4+gZ}ezj+O$ z{P>-1*IMT2y!;5>TCmHaO0vIq#8MqI#d!y)q8ytdX2ZN1H%4d>L7jxTOn#f* zKOECnDOW8SVzFh};GSZ4R{8zg8g9!avbyFlNzmyL>Uq>G6m<5VjYC-^T7#^hYP+kY zbye|&h2dG1-s@+c{>Xh>a_=9Bq_%X?0dDrh73EU}d8UtVUqMGVmlY+G;5(GhDtr7| zQT%WHz-RpsJJ$ck0_3QBx-5W15#QGyzW-pn|7`_;ox$-JCK&&=Jm>u%P~p<0MybD; z!TIxZf2*H9z42e5!~dT}-o+;4Dmzz8%V%zGZoa-{mgWB;jamLdj84wZzLb)Y2|gH= z7C-zuv*PJ*g+|MvR1}HiTQ}v!+visI7q0zy^;uBR$-j?d)w5Gm5AryvKM9A)4U%

-1&F&_Ho=O;NvX)phNlK^t10-*`KHCgkY z+X3!3zax>z(x&+waI=x2uV99Rmw{X!I>W4v_L*PeFTUgMG0_}+yp%3xe=n@>Q$q=i zx-3JFC)wTlJD%w4*W@s?147sI4ef#}o@GcAuL4zW^3ekDFF^HEtFdn zce0nOo{)V&02z=Te){DZ^ZaQyAcXc@oMD+4wzRzLaRTjiaf|(>7=R`Pcn#hQPyz zm+b%NM7nt;3}q?jUcb9D=f@%X`-aH~Wu=a@5aSly_(ld>Gy;kYTF>iDcj#*Wv%joa zwKxYn`s8ed64p@HOD^0TK6GZ{ETdsX9gC;|!nJwXXl~>2KyyyXI&5SSK?N}c>QbBc`Wq}^S zBPz!>2(#T@WGvVcWqpc)R$21XZ7TPB6v_uvZ)3~q5DeqHAYLRGB8({*?mJu#jfm>SB;f2xs~EwIg&a{vY$$0> z)C!@qf1jn$I3d2csQuxajbCpk8QMDHRkwFtW|IwH|~49OSLCbIq&;Cg@6Yi+9kTN3o6b zV*-}6tvq3FlNhNj%8#*^5gt^e@GHf0XO6~h*~ns3X6SnwJ*@#9Z>bdEc5}c|&nVkA z zH69Ft$bTaF=Bhy3RM6JE22B96n7Qv0Pa_>54Qdh_yK)ZUmT*0t*eOSO;gT-7*OwF5 z3>7KiNbnH}6zr<6mUPk<1Kb|_E!wcOrh=xo=bX#Cn~f}2YM?D9OH+S~sa#?DL9MG> zbdZ!|gOb8!RPKw;K2ZKa?Oy=_eve;=j5>@mTfUY}bBhNe*4s5WgLi``H_s6i8&xG1 z#J^1}H+ItZ2ga1<0`hIY;c}XtBlV=I;`i}A!y}WQ77C>LlR8`bXZOO*I{H&;cV_X; zgEF+AV>qbXdmooTFX3#rtsEe22Nb%{Qs&k^sC>CRPlj_DtSS|~4VIX00_Kz|7QZX* zMm9A@NMqj~8z5YRrpoa9ZFd8mo%4L=|ESf?f|cOorEvOUV*z4}`e)0H5>1N&6I2>1 zPcs!|CZpU@rBZ~Gc?Q2y3sZG3-|n6)=+34F!%W}Ndo%om_i@dJ(ah1J(cGHtouySC zQCp<9RKro|kKHMbyt8MT+e7XRtlqB{Pgfb1K$g?@EBZM{YbRW4wWK zyUW`pg`;7xC}P+B9Cim6$zi%P*71pM;UKbWh=^HIhY0Hw@z^yY%v?+DhAqUJPWCp) z^V1FnA!$z_G~(40TOG*;#e*XJjGx*~t8*R=5$2%Ndrr-Gs-u2^TbumQq?GS85u~s#WG1@}W>VwOfe0b=Z-=WbxvU>Ny zQr*caDwMdE)|#XMKO(D}hI1Lpr)~q1&8(_zv_{%~*=nW6Hy`zGU>$jn)>)XS``O$1 z8#2_Bv8Y_eSX4AUr5o8TDkkA%vpvQxW$3znHxccr}9+_rgw)ZJ|Ew9Y95U1@)9o7T;O35{a`R;ciVX@ z%?Z0(lL?{5Z=<-=%N4t0Lvbp*N1}7QMTqJBDVA*!aiZ95>vlhA^^=982v-z@&RJe3 zu4?JMf|+?!yO^f2y|Q3*I5pTDG}6JXoy&Fx-?shv-1hC>hMi>r4rGEKdT*29j7+|0 z)xxA#8aw68V4TKOe^RIx6Dn}mNvdIkhfQ=XkXq516JUS*?W~N7&)8TkHCv|E4_-Y% zL|BzG#kbq~#G`eck+Cz3m;=MbfwIX{il2r3S(rrdo5dy@rFz7uQu~?G8dOaU3Q^N< zV{6>p>!yJ;$T2fvE|#iCIkgtOQc|i~$6m$qER3wA*z+!>t?Yd3njClX+_)k$YdSz5 zJD6*APB#>p`LVX=UWll-wN3=AMVXE5-o0(KRaJ*Hu61d5#keizsdqG*l@D>8^z+11 z3#4I+rucx(0q1h`QqBrVz}#!)?wsBe>2%m#cT8@0^oQjm24-GiCMW#jo% zq89sI3JbU$%YR78YE9+ZFshEJc4_Y+pl8*f$t;#oZ8sbNXvweOa{Jt6=Sg~i?8%~G z>EP&)W_8)WK;yAYF;YC!>#|HEhv426TPa*hbX=6dxcj8V6HRg3~}SUj_n(f8a+!$=y7~H z;&emccpX~;qAMD|xQ}?6@th|6;B-tQI%Q1tw*bwLG_-4>CCZS134!?ZSSGKALrle? z`@$?nxusLn`G6CGSyJ`SbM?~bD0;TWc;?U4+P_U^*qNhsCeXD1R_vh?i`-dY`lgbm}AKld@MzP2t5I6#5z z|0XwdxUZFgjjnMr&CJx)1Sx%XNcKF?ztd=wxxdd#V<;qnpcA*Y0}C!RQC))+-=mys z{Uj)SMvKH?w~m&W;qA$I1j@ws9ev8GT2CQs26cUe*)d&l_w3fAQe+@K)oK==m;EY! zB;9DpX1OGQH0Lh9pkh<9oL8)PIDpw+JeE`m@Y=%+Yqsk_&%zL-Ek7qmZIe2)6mhC} z28)V(eA!r6R_&NY&74i~eT$@`mg~PE_q6PVg}ks=%8h^7OJK{G9Lx7FkF8_S&1lzm zUu#4a-#3IYr%QI^dMk@3jcsvCPa4-2QMN2@OCV7sF(7^Gp_Ru-*wwN@nl0`vZnN7a zF}3r@ro+7vkp_A(D(XunUWJ-I=><;Zbl!4WC>PEeS(UPXPl-ClV78BRi$vbHI2!|S zJ&UIfaC7Xb%APLl__TAm$GDo?&oG?~Z2B5im@vs9|4%^R5{1vv)5z?AMbgyKOBk0L zeq3$pY&Ij3al0C{lm7&Jo@5~N1d#DqjIkBwY2$L(sY0DC!~|JRy#xzbc$!{rqR@)q z^#_aL8V=D8>6vc(OP{u~IFEisbBdRPjWRj2T4J0PZs)QtW^ozODSbV|Ja0)r4b?HB58^&`@1LAHHyg7D?-yZd;1w~e z@oEpPOg(jHecMzvP_yj?PK@M<)BVJk@;Z$IuY@$Xs66w@oSMg zt%UEI%Df{>h`IpVI4z44@5i&1-9(JTR1;IbwM4-@jH0rX>E&XLN0J_RkX5~xmjC-M zZ*ijogbI2k&6%t{0AC)Y5%>A##sfz#xZmuw?uhAK{E|JuL$5kjj9ulSF?SPLVKp^b z>Z#qmyo%?vx52ypGFH$nGFXGt($4v0N0^pLiP<1r#j{Q{Qlr&ni7rj z9AlPFd*BNEA;bOHY~^E)KbAH5jVsAN0CLo2Pe#w^u0ZWd2HSu^`M?jP2by zO}Kvgj#u^Lv@0iVxxELkWLYNA5v2e%@K_mV>-%MeC(i*`Sx3CQu(7H*eX(1}*nOo_HYQ+~|RzoRS6%){sHC8@Dt z5|Cn)8D@Moa3eS|!|u8px#{5dM2s|w(rPglbr86f1gDb^gc}z_mlkd#MT&`uaD3)~ z%+f?SWKeOx2ySF!j#-ObuZ2UNti_$lRCYGY=bUj-WR(P_4`!uFr~XOM#-;sC3BLt4rfGMAm~yEUJ7Lnp2N!fi z!Iv-;0t9saS||2~O_7rdHyP-g?YNlk$wrJY@%GeSyBNo^z%wvoY|s@CpV4M&bU2+S zNWE^f`Dom_JV@=To2m6hUAyXK;;3-E63H`vV8JcuP|PZ{Ja8W0-`zj-qt*gLo-4!* zF+DyRU)92m&Wt&+yHe}JD~9K!sf(_V=IRD*Pg|rULKg>aXWT4Tau^+|upPQd^!wx+ zd@wIY+Zbv~u0?I-6>%I(LCHnHa&v%D94AD%b}xr~3MSp`iC?ng0AH#d;XOfrX&{={-< zGheF#HF}COpvcVlY=qbhH8pLU6&if_qFgf9^WvF@-Y7o;K+r^UKJ2fd zKRW40o>F$pyc>0A36uCh7>cB*)Oc)fZ$Sf0tQPsjxd4TGAAM(Nb6fkz(bWwNT9w-z zT%!Nbw$Gb7A!cdBaO7V^32(^)T>6XI{Rzs<>zTMfhW)*M@iF@D|I$Bj{NLoC%b}WC zMit8?Y z$oz&83xD=f-+)v9z$iujP|xdyl1%RoeA}E|QqO+Pf;am5(?20~(UH}Ay*SZJzc)(= zyB>2azyA+)ZyD8A*FJ961qu{*DDLiF+@ZKbaRMZ`TZhLoPi&?(k6dU76 zDKM&p2IyCPWYA#L8RJ_x0y$^99m)=tvgjIvj$n<)HlF)$v*1Ruejfy6`D4K)dIx61 zua(M~+CkD8g7+>%C)^i}a}DWXlhYfyX!GVE1d70wBv#9lP$59X45a$vy|;4l^8Eu2T+r z3tO+tA)tF&xo4eo!T1yWIwl&u?L|eeWl(bmq?VHc%^K@XQ};=-o(Rq-*hE+5ug!fg zXSQ#0S|^Es&z(V2Sq%quJ+D+3a%wy>3Dw#uto7C-+zvVn^hut}8#;OEsSIg0H|H&2 zs}GJVYAN>rwL1tFFst-4(xzk=*HKN4%;L&gb8iSS+>@YyxJ@qjzzD&jG}e0J!{uGo zETq-vc$56O;0JmE1G@RjUlqIJvBUjEw6>PABHYIGje<1zA1mBAu@fy*799 z1b_XL1uA8)a;d+0-Zd7io3$fMstg<`64;iJZKSGp{k}ZYUXdA3w~d=zLNg%ua-usY zBMA6XlxU@HKKW3{eXikrZA!&g)*|_wiOt}%y-K=%6%P2oec?jsDcQR<{^Koa^=FV% z96^-=1KLs>QH9X8eyUtfTw-cEmnuHhwy?H_q=rig(-8i)jZxJ8k}(wPX5wmmdH|U9 zHzTmU61kg}%KUWYvB1*|yS}>LDU%>L&eJu{S#I`#sRc-^TUIo%x_lul(4_BQMHJr( zasjjGm*X^YEV&0N`u^Tkba*L7Q`t#}t4T+tI?!*A20UF?GJPEzp5&t?(xjXR+SvhY z*?o#p(Pmn1iUa^47?I`0L0JPn z{OXoTb6+J{sLZIFl56$_a~=S)vA1<%zfS>k*ZN$oru;d>IW=$#EkPW-|{*Bt=|t@qW``rsta@vy%5!qI9|T3us02dBD!MLZ~@_*l!$ z4|>F`F%C~MP;0r)-dXKD{KX?I-ASVU*|xLT98a3gA_nHkHdCl5E?_(#9_l(ngtoc#UikA~_JRI%a_d*$4Ee_yxhKsBWBjg6O zW*em0frhC%y1#6Uqd2#ULf|4SFIi*OzA)i5=sR3OH&(WpobQ#%Pm1?r{mTq8K-Ek0 zz0_G|K{yOpoGIJZ1m-wqSieZhmgdb+mD=7Wmk276`6<{&Edp#|Q2XdfHU{24`j?kY z#i1F`G5Aa)vq5Y^UQ3)KNr~DZIicQS(bnN(I1KBtnnHcD#xQ565~gJ*#PRWXKFjGm zQAITLh-WxTp#OY#`Xzo|@=o7YB3X((r!8W{s6S;Nk}aLN z9WS|RM`$_OLRW!qyxQsNwcHNzKnE6)gz&z;IRm)%2_`aXXUzOp(8EJl`arW|)|}{9 z7Jr&!ZxF3wDZN&SEtl8Pb1fB9`O=D#aSNB%s!O!BoW`SwrH6EyPh2>a8D2TnStmWk`Qq0wBFHL&`V{bbyXf^%wM;!@5w{`$ zu%gAYcLwFE%RtQ*7Rrz+s46=ke;e-KUDqBc-DKnnR~2ab?wDzACiim9igm`pn2}@d zsG95Ttln$siij7mgEyhWW#LIqWwso4XQ!l%&b@U-G^g`B$FOlSfpHER-0vN**qLXN zs3LDHH8!o4vnU{*OA%6!efMsOs%<~>KZymziJdcGp)f{bWdnWIgplmTmlk_@c^f_> zry%%hgKJQ0G}~zSZ1{ku)vsa5ubw@Vk=)$v+! zw)Et}tjlh?Gn4Z)OMtkHcT}G(YJh`$IMsX*Ug+h!U9FVqrIn}JVJbz#FUFb~Ce6(P z+~*_PzA@stvo=$5Z&n!1Kh!p$=@y3XJDpkK^jvk~1Mw;pkh`O7d z&J-X_WTc@d;+`b2s+x`6KN5GpeuPQ!T(}KAfD6Qy>Ab|NtPd_(o)w4%_a>%TMgd#| zRP3F(d^OT-&og~LP+%1eEx@$v2XVhZLy@;BZ}(&FI~8N8=czy+u@4tVVtR=9Ml{hG15CpX<0%Hz$sx2RTRfwxz}2$iI24ox)ul z=v)Oq78s@0%l#D>zRe9zr8G3UF5!lsI%A5+4NC=Is0g=(5O_N#lu1$BRKPmgtl}ak z>F*|x=@P?wUqFJs;AWEFe6$#Ld)82=rCXv_60<7*;=>3UXieaku2q-9R5A3o*+C60 zAMv>&t417n(j~bQhi||UnbseLT7jY}Sc%E`b>w-k#TI_W=Dx%DiswBq`ANb8onD;T{4=d*2SS)`M!nho zaQ+F8>F?+~=z8I>y3G!l-tAI&`-AH9AznB@X4wVq`j;4k%l@$9@T`vjyEl@1%f*%S zpdRcS6T?~`_DV^%^^LG-m;lm<1uxxtUlz_uRNiLakS#JECPV<#&R39v6#Vr{eq%07 z8ZKwaUcPs7DNk2bh9{a`pczsE2D8m1gtBJFW)%T;K?hYs*2nG&(F6Scn;Hi*<`TuC zVYw4lBf{y8(ReC`QIpFH?n4yHsxxw`jm`o!y&I`?eGG-=EuQg%N3Jl^D1CCOMCiDI z)b4E|IMeJZZyjx)^B zmQs(j@YfcU^j2{8$>ARKrNu$F&})LymznvdaBc0%KwLuC+U)4~5TI(n#{vU$Vn4q{ zOAx{(jNjlKv%Yti5LDaQ{NGr>-hS=J?Zr;ju>FWi8#|NO^Z{tv>D#XT)Z^<$&k^P9 z^Nd^Jk-kFD_hPQLSnw^SOTw7^`sJ&j`2wSCyi~E3U!mP!d?~B=R2q>Ez$i?F2p@^L zhqqpMue^s*nI^-IFya~CZ49he{)Vc+BQ*A{@b~)FB}sqYv*Sz{ zyFb7`gM-zIo6g(EB9SeKSXOwP@!ivoc?{d(M-jm3>1mRQZ%_=P`*VmIKCr2uz|G7q zGCgH#OQBK1l)k)>lyWdNIK3DjRm5%}$(kA5C?|ebn1M0Rr;9Y(JRjg|s#_cy!BQ1z zax~uX&FNaqDoc(?lTLNebu}}bFy0U55tv5CPDu@ww2e&xW@drqg9jTHwqW(dmXwot z!p#dA6<@k}EBdZCY10hk4kdDhNs+!PYkPiJ;*e|#86Kk+vdOQxF5)t_W0*catWX0^ zeh-rlXfXTg^QK@5_D{Rvn!U*TD4+-(&sG)L*52Z}5|GQ`5C^#&M4x`|w$+DYG0ZZ8 z^-bIl-RK6oGq%*KHL6yIEUjBxuH#gO7mt*tb{#{b!rw1{4h-ZFXxE^=NOULXP#fkS z;1V=zz4VJW5^Aq(R|#-Da${qfDc$Go;U71Coy`_&yiI(xr?syDcqtdP=n_1E!sn7H z?Yi)>Rs}<-(~|2*e6wlb3;ob-M}a^{!E5lJPI9u)i#IWoWW-pp$9@GGSe#U?SVM$@5+4xZTehpU2 zXZ(ns779U}KOs`5jNVBbvEL}mWEfBu)4yE*rooCOE9fhbt%bUIQ^gx5Xtc-yRyANY zPCk0l%gfvH_oL#fH9T=SX-STK9NKXu{cp?z7rlmf*SEwq^iSeh>p9rI`}??N&%-UV z)@JGo%0n)(sEhEJ3&tIf1lemfOXS8(tdg2YR}8k#t|d77nNp~g_&DQvOW5hU=QQUm zT)Y7%s{5^3gmj{CMt&FZyRJ_L845z>AH2;3_kLT4%o9DVt_GQ$5TvzRR2sSEdYr<4 z=-u=eNqg-CaDPym2%zJ!YOM{IK}9k58a^!0YKHs3L`ppJf4}rF@9?~dkiI$hwo|H1 zJ>`$p^dm)-3W_@qm&r;^I%X*q;b6ZFNWoz++X^QA5Zt5F=*I7YN7J94M&0P~)5D#m z(4{Zp!$GZ^^dK{K?y(=6#$>jf0sFZ2md9UxIq?+M3HvD1w?aMehv($I{66S2{*&@m zr@3a^Z;rGv^uCT^G3m*^HF`sG?25BpNGy5qt@kMVfpfZiJ2CbBlVEsc-Y6r<4-19l zv~wSu>g{$s>rZQG39M*ou`Sugsr+HQpAYuKaSj5xfN_SO>Le`VaRuiC)31JNjJ+9m z=kPVg2+*!d2^HSF5(TwdGO4K=zSD3x7;zHgYC^YD@lwc-S4{G1Ra&iAR;6@P@Ditl zX+w%8_AUBCd$vdWpv?a+3eO3>sU_g$K;bywA0u^VNg0Kxh1p|t=jY9Ig`9n-ZUF$p zk$f*ALIGfj5EchZD7X?YY>*tMzod{_j;c0>qq#AC8&ENFuHN8WX6QA1-_sc4ZK6sX zz!^`s#WJQ4sWHQuB4IZ)JSq2ytbUgpLxHl$7$2dF#_67cDoMfHcLlrtL21mhd@gRs z-XJz$?}7$>X=1409pxE%6Bqw&@Zgts+B3D1;{CY-tzX~5C`Je_wnEs)89!N5{N{GM zn-lOt{qVgT^cFi^!6289qU4hX@y-0F@EGVc`98xRtSVu{cqdr45aD&dUPlj6Aj}sO?qG^>y`91HYNBnfq(nx zl5Jo{h#*37G-6XIF&~YvOkHQtCO(Qye0XO&shAJ}JfRTL%Qg4gVDH7!QP6x-tF5}Gv6s=7 zOvynj>!ZxCpH(rJf47rN5^0iOXIX{m_`TV*Qn8~JcaaVAlV5VPyBCE_?w<<2jJHeM zGi|LounTZf>#iHcixSlR9H;f27aG%ismltqbp}l@LL;%Rn={s5xcaD z4jfvnbWY#=IhDORvurMoUaj)-9Vjt=ZJme^P(AquY59cQy*VA>5WBk0+MAz^jxK1I z7E(Z9`$Ux$&0dAeSu@**-0R>xlZQh=E02ypv*wvA>0@4khnJyeD2(%XeR7hbHG=}4 zh0E($^5%6j>PJB$eq6>Muz$IcIy1A4XDk>lG+R5+Lq0vVUT`Q7>9vCtbqXxq-JU~= z06rSsbu$$TR33KobL2I^Yf{?!Qej2k%H@$U_sDg_akuD^g#65Ejqrzg-o)_&4CN<# zfeDw&!6Y^J@wpo=c-20aDvt*gC>>lAb*U!_NVoNYo(7t9&DT}2R<-}GgN@>Dd|TUh zcO|KA4pZrHz8Re$NcdD_0_Zt$`VfF>oxd!=e`vkqRNd6--KtdGrjAn`vE+9!yNSbG6^( z3b)e$YAIA9Lf@yWgl_q`%~$qga@9bCxRc3u#k$0>N!!G6W+dBLBbU4ETYb$!Zj+pC zxj=6uE*+WVWd@OwdAUh z`dgxRj?W|1%glzr+9m;>H)q?go;~hMO(Wx<<3df*{%TzpBKW0$HhDkDdiX7Q%s0D_ z**cFj%;5Hq;gC)}V_!nR+Y}Y>5?s&%I^X}^ko0NXpnQ-X>5~T7wgIMsEZ)>pMaz%I zo?l(A+p>QPAp5)X($H0^t|iNjCj7o%(_B*V9*FIKFOcFF-5+%VvsQTVeb zDJ1uYPYP;rI5F^h#fp_xQFc2@>r8en=n*h2kF2jiga5yV3A$iSRBGG#`U?LKtXL}f z5+nU3^3i3O0Y0wm~NcQM!Cp=~>b-0gjH0Ftf4!hZ)Vb98D=IDtg=`hYgeb_~%5Be4)n?a@W++ zHWvT)i&(X^v_?}?Uk8aJ`N{(|B7evek^^---`V{SnYnedoBOnSg~%?jkO?nRf1OS| z7=!i!-T(X&cGA?)kfucYFZ@Yi(CWHR?9hH1X(Bu~<@jwZ9egk^tiqc5bh`jKL?BK* zg@Hie@$s>HTlPQSYxr(sbJNAyxvsu`&i3N|rYu(U7P4Dyg~zeG&TMvZz;t$wdUke( ze8q*g$iEZyQMU@2q{F*C`LizR;`+9W8Y#c|=ZP-+-wyx70{?%WI{4>!{-2dEBkf4f zgVqyZ4iK#ZHJE)<;@aH4E2w#QoNtXc6GHLNRIyKF1=kB9u2X3gN2)t6m-pXXZzZbc z=jT73Jo$xZF+>}ls|1b=-Q;o$iR}!5DHG{UI;0E;a6SE|I@4)(y$*JvVwQMTU{B=H zb&l^88gPkc;5Yg;S?%>dOX=Mhau_ajjIw1)Nb98pYrHO#1}NzUy_PQ3TZ(D+AS~Zf zK)p8WBW+i^=$3c*`rUyu&VjPNbeq(B8tK6fGP*=Agb=eakuDGCg;4mkFW)xbM6Bdi60NHp)=gw;pLPUzz%(>| zI7Locd*CX+_rWP{s4pTFjYBa%@Z`gCuBmJSB^NG1r^l4J)<8R1%~a^UD!O2E)KIQU zlo8uHQ5Xq^S0F-&4{s0f?a3+?cO3q@|Q?hS(bSbbhd?;!N3;OO3O~Rq!u!ztXs6mM z2Abvguf&RC`ATBbiL|Y(qL16U(jd)W%ZCoc@!A6e5E82Fm1prsWx>~j1(q2<1KLvE z6mdKbHu;#O9)CWWo3IN@l`eDL$Jlx5I0p0XyZO0>BsF+F%so#auJY3>(dSlP%Qh}6 zPdYsTSVjzDZ{|j%%+(2PNOX zD1W_PJnQP0n_5?*)2RNrWFHLQM)h4sozjU?AnH*eb8PrIGsJEX8kSopNOl^!NWVXB zD^NA!+7^mv5IiAq^_5CYkn%547k=#FNtfzW6CWhF9kPW$cUqvl_JXG=f#^zde@J0d zkfm%4f$QcOt#TS{;<(~3Rf#j0*Ew~97FG`Uge^Zxt;UST zAxhL&SdomSoMaIa=pc3c2PdRssQ|4Fy5qatKgD2MROcifq2zWW+H5)WART9eJAEIB za%19ry-bVF(YsMZz9wp6a236|Mp7+X8B-Fv-~Pin3G3ku!qUkVSiU6MeUX*Mkb}K>Y@VVFu~!Fbob}sbbK_WPw7T>c>)^EhwkWW9qS15f4iX z`C<#c0FM1(5?$I<*xvM}c@i4zH1_~mNqdV*JI#Onfx$;*$R~2Acx@Y<6&xdr29~Qt z=KLv`2Cw45l36|$+(*Ox@y*oD)Mwdt1%3G>97{Z)gLTZAg=97whT)cJq5`?YLc)j$ zZU#m^?PjsdK6~0zx6b%PXlydt->8phgVUFzfD+qp=v*5+y?RN)5lvAru_HcdS>ogf z+{Y;tB7vZ>!K0-WPr?JM8=B1>nQI0a>1+}rOEtAKCrBO1d3jh>RPr=_TUdvI3ghzl zFV8a9kXzG6VIA6OS!97S_qGVR?_e#jceaGWUFx85y+nMH`cORlLJWJK>|^Z~CyhJin#zD(5C@P}Tx z#8>>3BEqsod*Y{Xj&@w9#f1J!bblARmj9f7g!Ff@Z)IO_U{?AYdL6q6Vka zS*ai$E;=3Bbr4?AF|DPd@(pm-Op3{MO;V#JBcIrFzyMgp>&(neFL;HmzEior{t&4{ zt0sy|ZbZ<}<88=x+v4iqAMGX(8#g3Kl&L)%k(MT#-%tHJpdaBtT_?MtwU6B7{NA8m zaZD-v5-Rjjw(|Q=AMSIx85%YH5a-6er_&Y+H|GnhD$j4*Ocvgl0cRMgBiD+l^Zmn6 zp4u8Dhp1~jtJ6^J|MlNDC+LjzEB1&6fk!_U!<8iMI?*^_Pm3&TpBJ zJ>%LyPx7<317iBkgC}sTIESPWkhY6=Cz{$miZm9ND{8M;b)dh3Dz;K(F>}|PEZxY`^@}{uM(sOl?4PfD%%o8(cSE|MLzViCr}gr4O4Y~Au%r2ev3Ff?`N_cpKZRww3N<>^oK(qryr2( zGN9+4=%FKvP(tAs9EBF`nmg0cVGmB{ljShu)7M5=OSd)*z1MAn9T&Cm+Tm>nnuH72 zt?7uK(l1olS@*IS{Fi`=O#yAPQ2iZ5;EN| zPZQG8!f*=X37c_bUYxW%XiGFW_p|8F*$xl6r&{~O4Ox~CZff3sf~MdDEag>H z932ZVNbFjYPhdLH9MK+X^#bK zp2>g(L#+&U&xXlZF)l~eGOHDI>-(*;`JtAohn1>&F#Iz3H_6dm{^HCC&o6bBz=aQ@B&^iN)(U6TPWfB z_2ywq!62Yp_0)&jRx|&}%UHn<>kjg)Pm1)NmU@Q0sand5pb0dh zA38M}Wd7E%!-~Ncpr%{^1J>x7D`Ef=FuR!(2~F2cZp!1Vhj`1vKQ_To)4%l+;+m1L z{B=dd^;>PFXdAaGZ9F-LZJRyh`-DmuYiQ63_*7Q8$hJ9|%bV`TWEhKK4q8=Dq>xqt zgz<;%1+x}rmOk(N&?RFrUkSn!3kWs~yCn*J_pD1SRk!?0{5mU)J%?0-Q9@?haHtoVY) zVmH;N^Wi+NO(V=R?&UQ;1mvkv zF`TOiKJH^mmsG3ul+@U@xD5ric@=lcq*smN@0w#+*Xx?OLdu?Lq~HK#`_ zG8h>p<&Y>7gaJ&9{DPuGd87yGct)4}PG&=_vr?9rxW@1Cd1{fJd|DSNuuGpAAdD-Un`ifXJOOS4&@))aLC9gh(74xysWpn0BN@c75Xh2Xd!e;vr*iaK( zZT5%?`jqFm&GQDUzs+U3cLsm4}vl5s})0#5Id#gU;zCl$tuFg%pO% zVka)P8D@G0ll1CXbg*FC+ij!~fhhg=R!HwS#C02`BVn)R!JqIwI^xMdtHgjrXuC&; zW~-WYbaXaiKf>-RayUJ$E=1jLxkr&JardwweA20*!^v96=YJpIfR67~Hcd5&fL4>jW6(-RT>a?|(r4Tk#fyx0XbT+}H>MYh{zav>?=}pmo*; zC5oc`=$zxe%8MLypks3;Zu5=Hb1N3HHmA@8V(nr&CP_SR#`Rd~^^l+GW&^!67Bl`z z8QDCl+vLKU5C}z5XA?7*fd0{e!?N~*Em8A!q+3XH)o>&o_02)1jtt(5bYDtGN4jjO zav@R;mNW+UKVN#zMih5t6K{0j?SUUhyCD#$pj5HlB{S{wCvJQx{!I)K!2)qi_BI>N z0#XYmUaQyWbAC5vLDUw>m4@0qM?a^7#efrv^RCBhwWH()+Q#m^8A=+eo3goWntGOY zkti|xd;8+H^tw%=EWZLKcUgL;`z^N*Q{!XZc{5@!GS2Jp`xM4~3DgOot`?4vC9#WO zrD?#Zi`GsnsX+{ySGYpWw#o$ghD~;{`QTlfJ+sI!yy`5o2nyxyI?L1u@8*Y&WlCjZ zFTfJdM%P=ns$8u>!8On`MmwE z{IX%p@ihvcYiTEsx#chqE=AQ?!||_l0)-le%w2xN3;lquI30a(zHm!H>##DiDa-sI zrOIilBUZFU)^FL#Pt{c3TUP+7BjTSRRfnB3(IPI=0H`W9mW$y|#my#_#2-`{6=) zj=h|%V^{5SimDP`smUx%tM&C0ynv+{t`6Ny8_l_sfRY?8yyO~Vkx5g;;*DhoAFl&Y z-t?3Mwvh5I*s2q8i($L+ch6A2&T+hF-Q!@)zNPHF(-vxHnOUn}HG|Ue8dUP_hyky3 zrewVPCDH{u*i$+)U(Lwecyzza>t&!tNO|4|j&(CQLpd|U2)m-ig=Yp1US6q|LT0i9 zLD7$XTDh)oT>FbGX{LL3_7~(%T5vyQI5C)OX^^<~p_rdn<#b%FSY8k5+qJH)SO%O$U`LcJi%URr@ncTX z%#iJdct%l>cJ2YvuMbAp&E&O=8qCp|Vw3GIySuQ$bL}LSc4ognL6;P_+a4F1Tq-@I zOZ+VXqq`Ryvk7ja^A>_icUOMkXlNBZn_-UC<4?D}Yg&>zp3Vz!z$T-)j+WNTTvDFb z6)K{bX~V&ZLk-0%-5w5W_+p&~E*Td*qw-y1(Z5dSaYi@KK#-ex@>TEihYI!d%ZIkN z4^l*_sboMv*_t(xvrky7enw0}pS{sm^_vv`Q2=`zT(UTnOy>u2r2~gv2Vyk_olC@n zUg};)(!8OlF$aCqE%R!wdAR@$wLyJ@)ZSxgr{rLdPv-VDix8`818gVTRKkp=3h_tG z(fDu*hk=?~iTLB{MoD_UuH6{)8iR)fL3Gy2LMoK`X8TE2*zrt!5%X>eZsEmM_C2v6MLvnjijJa8Hi}n<4}Ymsf5uO;bMwvCJ^kdVy-(q> ze6z4lN-9|*($8fCX&?vZbxa;zKykfGYvK7>B|1{>RIN9St|5@y$i{ONvj-L=muYV- zs4Hpywm?x?TX_{G(Pr1@M==@Y2P}n# z0*~F`cyHlk%gU@h$VoqO^QkJn#A{|2AD#TRu(C8|?R5Qsu6Whyo=Ke&6X2?6AV{f< zwit_sS;eX%tdY5YX}B;E07Jh4KKNToRGJk7yX*k9nC9O35n_`xJA<{dKD1;H`zjo& zrl943p$#{Ti(|W^ruq_nssbxremW&CDy+G7P061g*5IHl|%G zORHvNXQ2j-lO!|5*R2&EzZP(2Eb0E#e}WQ5n-N2Bteb&K*5z(_aywVh0iZH1({bPK z{e0fEU5P|z_d}S^m~jo5uU%{EdrA6hZz=skRPKc%hdNKao>~M&n3!|r$Fdz<`^q7_ zW}N_qL_!nrSQhyKTx$*BdIr2xg44YA@fHBjsl-#(d4kQ|ri&yKd1SK=+q#r)aTc`TY9#KSgB!-cv>5xv+NL z<2|OWZSPpDLw_yInp1_8z3Kl+#liDkq$xVZv^f1Ehljr(Kcemk_bQbksCSU)a^Xk_ ztbk)COD8gp({GRLm?h*JU*nLqATsu&K|g*-5T5WcToa{d@xEYTqP`c;S zz4LuU-;vkR^g}l7ll{niL!+dzNtZ-wpUu0Z`6 z|6mLYonX*?KK7(%Pd;6ViUGaQoT~X&I?mRl=flk7UP55tE2DN!EHx6@eXm6^({pS^ zp6QX6x(bje2WVq&Lv;Zg_VEun781}SXCVhBN0I3-eXDvPXyfG(H?Qj}qE&c948Ta$ zg3Y&xpeu92>F#W>(X#{!vgSkTc7{OD*HYndm~h@9Py5TqT1iq%?D zcDqKC9@ephWZLqoe%}PW#-Jq8boMM}P7NG9%dobRe!S{Vm1eXb(p*{iX`2fkA@@ph zm4X1q#B6@NkU&@2_vDeqIZhnw);HJBb9Y+5bREX}UiVoKbHAmpb-l&z4tG+qJ0SJV zU*aJS-j&#!-&)M;g!}X%J3EX*eMI*zeI9zV?;!V;4jah_`O_zpTtIsYcYbPxAH`wx zkFHE9wpx_)Sfc0NK)989LhjE))oAmvs`Z&$ZfwfFmCjwbyLS>4$y(OXGaWtoD4%SJ zh;X0dNamS_?rm65VzD+1X-#8IoNQR_ITl)LP{wKxQ4Kn#Q>u8Kr9!%f(dy6WAPAsx z-bO-1V_rGXucV&q410TPn(_VnfHo|K&ArowF>;T_SEa~o6 z>bg!$h*i)wS+=4A1u23 z-M058Fn|3`Pq*AZ-;{Hv6lh(O@i0EMZ;Jl-Aj*&ub!^JH6a`2#VZQfgq@&Xjm#EJU z(QQ?6b^3cZP*~9^;jdxtXDu<@it=PVcmF+}@Uo4B#h}xkTb1Aoh1kV&TXn@^5h7Ir z#@{xj`Pvu+n4b>C0#wbc5%)>uE)>|RucgtUaffF&Y0uxI5%=V-43f|UAw`g&kH z{X|-}m-@-ZUo=#&@#x$+5@=GTerEo<7_EAd6+Rvvy^5Q3!`g};bLr>^RKC}gUPzL6 z)_Dw?#b%~gwx_vE>u zi>dY7ZgY*l+ZCC&!=q#4{F9r!uO5k=T#)zFXY9@hZTiBzbH5{=Ij4AT(nA?^>8Xl$ zxCguf;N$KPE}0*%FHhR1xX}N04#|%elx`^lSjrqL8QrfxBu!i56ZiNu$mPXqg{!*Y z*;Jq};Vgm6ya5*7139|&l?9fn7oxm}84-p-NiO7vNBAYIYy@z|{s`TI7!}0qTl!AA zU<4QAxXr@$2ieW=wDna|t&0?|ZQ@9@^8Kdo>AYl4zP9TTNxIRDrfPaQ6podCGv+W_ zkQg)#G%z{hN*B14ZuNHezE>)p-Q9AaGDGCf=-EUj>Q?A8tj^S57dEzD0NcB_RdeJw zs5;vAy2LD~w}vr!=54mj^*&QNT`LXN#0&=D$N8ZLaoA-;tWf~bufHGO)H^rK-?HNK z3HF!KZYA`y>NnjE4EcYCJU;ouokz!U*E3xY#Oyw-&1~-pZ|NF& zU5qEM3;lM#-8|!jRt*ZawP!78K9%L$ACFuV1)Hz%)<h{x@m(G|y3C1Xs9X@v&({?+9@Saep;+8^#9O82ihYaV_M!=S-*kJ`24~(~)mf-@ zlHQN#&Nf%I$t>bBfIQbwjBGSp0utXFul?#3Ir>_1K)kua;!_?NLSx69)Hf>8+sisw zn*waglkXs=&)KPiuRRqMpN0O))y?XMORnPhzVYe&75qS zZMy{%*|s4g-mrfBvI*r5nSqn#qgm8JyMrSPt;$w0yT73EGV4BAy?L&g+fqiG;x%#C zc+>ij=FRA@fy=t^V;se#@Z^OVLJ~`do3pBcGW|USd?B+AG(PvbSM=o9g0xVH3iEp% zo!pZdtd5Ez(BIX=C41t>ZukXh1-|x50$pN#j6dvG%2+U>gnZ7ThFR~)uQPzjw|QsE z)nJSpRp2*hxt>c?z17s55ON%LGVe-q@?k49<5Dxx5_ds!s7aF#QJSB8-2(&Z;wtMd z{2E;`wr=u5-n8>a^C6oymuChbdZG>km*s*}3krv|7{)qpts5C9xa@@n=q1!anBu9{ zIJ11O+$X=+!%3Sj$F(o#*F*5he3mmqW^tC2GjB_o>Z^Kz9F?}9JD@UYFELZ~!{Z)2 zqXcyMx9!>exm1}Z$E#-(&3{O*JAo#=_vhprg7`S0Ja!{nZ<_<==_=pG^fW78V=4}3 z!^94{-QVHk%yK;cZHT=ey)>L>9yZ2L_2OApCu)fS_A}O3D4VTJOq?$s?k>p@{ki8z zv;NDy`F}$8A3y$ANB93j1m*vzeEr|D4F9JbgxnB`20f0)n%`Q!bjZ>Y*t;X=pIn8Z z4U%OtFgVPUd~4!&@r3&7g$3(4klz6En34N%gwF=KA4I~3xEu9IZbN$o7Af0%@$m5}0OGo%-EAd~p$?UYkj_FXLVoM7T){%82IHG&KC}`u?zGn3*UGz`?`2xVZSI zKis!SO$P@yG+`usH4M){j$by0i@2uaA!*mX+M1CNLHy=zk}?yrT6PA(&H!m9cs}GizN{_I~^oHS*#6u_x_(% z*7bV7c95*#$?veL*`~*lpX8N_hM^(Jcw=&Mvb3}`Tjw<;=7)cmrJ*M>TKN4a1mC!{ ztW2C!h|3i`U37I+Kk41Eiu7|Oy?gVY&kMb@l986~I2&PlH4!5AbTi4BZhvtwCq?ja zVkeFHIAx(6gB-MS4m(V+uuvIJm=`gb^SpLEw)5B?J1r~*N~{;0knpc~dLBZPTcI~u zNIh56ObVa>nP)n(Pg)m)q02ZA5;l7^LE0+JXTSJ4cpc_Bp3c1AioY7LgL15S;@07R zb)0Dj-*O#BIq^HJiQO7W4}x@FA#{+C(5h(_99ZQYJ!fG)v|>hh_}R`bbrlZGK9pA; zh0o0|)1-QM80aBq+r^?g@by1u#}U!c+-z-ajct0(8_JbZn@(iVmaxUGvCkE?9%sel z1_tCiHM_SB3G}1eKgHfPC7$;*J@H|zoDrX?_PGcAojoQ;p7}HlWQ9e`#L-F}>{t*E zaJwC&Fb%1{4(>B~e7t&Z+o^$AbYveIzYOaB{O3vd_GO!;qqZc>UF52(dUp>aLpm06 zGvLAXqhe?KEtzL?W>JT84W#jk0o-`mOLUVEAyMFA0v{?WI=2xynrJftn1@>pZ`Ryj zw1G?1z81hU0=yq~xAhlvR9CMT@gA;Bo(>!;ZM_xi<$6*^Cw_%#d5y71dwQBTv3 z9Kihr@Tzl0#u?##Q$?3DRAnOU4ucxuWieBZB70AGWV*PKeUj z2}o~H9e|w@C*_aB*<#l{e*J7~e(Sa!7w5{&53WLbkede+E!!#>dE2o(w5sL|o5$~O z5GBGEVV7i_6}b_!;yXO62pF~VL)SJV{7ZO zTj_GL?k(FsSf^&xucRuzP%CM7=9!D*9e!2G+J%7WJ#N(;(yD4EKY$x6Y--zn2Ywh_ z6K2r+1tb?eKT6OsZV|kC%mq?L?|UTMg*V>vO?IyGXYwlXRLSQi9=i3->O+^0Q;1zs zaZ*g4Qw?l5fhNf+L=3hNu`XxczWp*(XSQNXklesYnW?e?|+_aeB}y-|OutePOv z+OSr|-%$r>rzZ_suM+d#`?^^it0cehbkI+(^(WU3NE(+~!!$!qZk*_{;1b{$7%;i4 z?-N&;x~u)T=Mf?;2EM9gvzmK@{AoB+U>i0U4;~*N5F33nn6(yC%w*vk=Y-KF)Hqm9 z+*z+}K1HI`=0AJ*{+PPmOGxn=L?@71nJebLtJ;f8pciBJ;6cVVQe~KX=gp^~7q3#U zw~3$IoUP1DrF2+B-g1(xJwAZHdNYT+{C9<K$h;^5sJ-Ll@PI@N6_v4 z(l~k3IBSR!56e|>?6U3CW{MVK$gVEy&e-ozHe|VHF61`0bujhk;`bmPkq=c}xU9qD zmJw0GP8`mDre2`x$|*TIs1e-OOdg@B{LBAw7A^+gU|s&ZV{$S!wL4{T5n|tep=gtl zFWq@Zc5Of`54rJh5Y@sgg9DtaAv9TIoy)E;bAvZ>%PbI|?0Gb%&NdE@yU}_8^1|Kq zTG`XXPR5ylC3bqY-@4|R@>jLzGE(MC$SbH=@H;eH!yi$>Lx#WRL1O&+-%Z;*+KrTh zG;VPh*z}zHBMg_vwcCnX?~W+HHCDm4Xqh*ydN!v=N?O3`ym`5?q>C5L5KY+^BpT

UynYU1Nj~xwMP+5D2ZFe2N)jd zTk?w4y2_GR6ffTrm)K#M+iss=d^Oa5tP`ayaiLux;<>+uYhy#Q^cKFkF&~d`-ws)R zV@*uPh^mAU`Kwk>+gVtzAf>0@P(z>f65`{2(CN2f-b^IyeL}?_w$UaYw{GC$ngPoT z2@aEd)eR*S8m)ghM~+~h7XIRO@^I*K^IPU+H#p+iQC~QgXzO01^P^12O5y3gT#BaG z)0M2E;@R0LLF9B)sD@s_d9L#@GS~jLKdcH0KiEesuPNXM3txHb zU(_}EHTwBfXc@RZ3{WnA(J*&gXy}*PDU|18)!;7$MD2SM2AIg`-|9BgqL~*vzMHc~ zO4v?{!q&`Je6@u(d6D-@L;6?v6Z!lxkesMT)IU7+n@1x7G%z*FCIuop1wf-f+XB1oY=`3Vi)zEK) zlDV_wWHUEP-C?dwFw!Q-u71E>1dD z^4+t6BY4YKr#0j4ZWBE=2y7X+rKDq@tkeXOw(>lKje9qs^kR8^?crdDHsA26HbR4rp#6QP{5sHmkL!@D(`R&0G`z6}JCJg#qls61KJOeeKoZy(20k zX(s+GB^4XfqMsZSb26Xd@{s-VVH_&rJ?nsQDa;Lm+u72(Nu&mz=dJ~n0BfJNg6{*> zqwf%4ng`CqwYK|_u^MxmAqGRfc(~{i6!`;00~;Va9XV1SuD@zM!64PGYt*!67}Pk< zFFuy4Xk6{wKH%OMI3bF++r!S_Qz&rUC1Hrc?{MXhj_iA{Zx`p&{d#~^H=*N`7AuAh z2FZSPwo>jAA+zRPVp38l%m8}@A=jlsxG?iz;SzlaJ)VvsLOrWh?u$KnCf(5P^C`*r z(5~PDedJBsVa*EwRP1|+3Po5T1~vX`$DU)4<&~Fr1*3!!b5^!9u8CPHLX^6S(svIQ z5=!jCqMe67hv599)in<7HRf;LS2FjNZ3v!OxBcrcTo?9|3hbWJi>IRvsa2zWylc7b*JEL^Rta<15jTH9<7Oy9sp)n9kV_nz6rZ3#H#N<-~g4R zrd--0d34`5HgZ=fZ1nMsHov-bDVv-e9XK*D>hDvO#kOq6yl+rx`Ze%VeR0Hpf{-xR zlaJ#_&&knZ1#bOGDejrqv`77)rbFc*@fDg9bCD)iW!PRONeAB?pbiP2IlYpiTc(`Z zt4cF71b1wOHH~`h*Tc4-N}vKY-gMAK_(#EBOJlRhkU)gR7Q$oeePn(QR+9!7$H*tK zDn@A{OXLu?+ob87{)7~C7qQ%Ug_#Mp3_5?+MoB^{IuXAc3c{6vrgB4jvaOj*?c+MGfSV6U zN#>|E3$3d*ln;BHUKo$`Dhqe**%yLIW*^S#B8wdA0=nO@;^ota$`?Ri`F~R1=YU!S zQ>3v;-m||ORa8EEu&{1eWSIhuswDW_--Sz9^en>v!6DoMbI82&PwJWZ@n%!V9(sI) z#(_qsSqxHDzBd9s?IvieyL{=I^KxUOs2-2#wb^$RGCQeZN*f;!pj<5=T4KaWMw zvjT3HdV*Q}x+!EcYVXu-n}h!&7I0SWJzWt`>=5kC+EFCAcH&X4+W^ZXak`uj??680 zqTG5I!e!XbTvf_R?@cqTr$0N8?5JrdZ7Le(U{=zpYL#8A^713^5SE47cye9L9Xhxw zw)D%@oe!hpgZfG>sQ*-9@-%SOEe=T86lLE54?5`T)rc17Q~F4VVh_$hziDoB!VWo) z^W1VsL;tjr55AS6j#e>zPyWQ-*+{xgrS#fU1SwR=@Q{=`;OV!N+=h&8ItE!CqEDkN z+$~|c?V(mj;f0VFP6onuc{e1`N8KKufZvkNz9o|vx`au$O5j<4DaGV}XJ9Q_j~eTI zJV(7zF_Pui{+tcZxw6+`N_6+zuS@3+_Hp8de^^`>x_`I0>#PHN3A`qv>;I4 z;-m!Y`P~fZpM2}QGVxe1H~kM=L;+yYh#4P+w4y9PJurF+DG0^5`RfJQgZ=SOm5OmT z`Z5E?b>;aFU_~Zo7EN9F70-pQtYSWe7$c2^e{6(XMtn}V$kA88Ps4P>y_kaYkp`SG zsB@KVv$t(pG=*B7NZ6a6CBC|W?LU(HeB~p8&LssE^BNt1mdI#!3l=8E(trFBbg}Zh z(JEF^wpG3P!D6?wsR&4g!<~h+x#U*V+adGOW%!7vG7dH`o3JX_-5_Sq{s>WPqR(*j z_)U(lvdJ^oXUR*~T1MZzf6yu9Vf~`sf7oWszM>q_QW9REPzetl3OdO8L& zrZX?U^w4s3t$`~$UPXBQ+9LlB+oafard6fKGpwty5X)39Kyg)V|7cByVU#3bT&QBQ zd8vw!@QGWmEA-sjJ2(_w6tc6cP4bGx$<}7Pr77$qpxHTabX;-cdic{e$R=QUuAoiG zZ3f-)+QK$I&Uv=|6_fJ|Rx6u8Zb$N1!JtHMkfyTl$&HbaEK@oHQnjirjb_s>Q)>vA zGf5t0Gfu;+ey73CnAqlXJr-QGz+Qpsx@Q^6&Kj>%t~C@{QweGA-2_|Lf?Cgj8UDki96{POJgSs@|GJCPZMq`n+*Z_4a;42v3|T3)z{J z_`RKnH(s`5hO(0vQwO193^FBa>7`;LqKfkPfz=#N|!IQ35W^M(=n0Z?&)Ne_SSVuOy z%2Uo@`KUSP#VR$cF|F{~;yfva>hCFBetYQJYdY}}E(Oh!VWxp$-k#Fl3xb6vhk4Uz zyITEe>fB~i$qFWV1_ot~P+$>8{1SoP)4>grqRI|gX)=spCW$Oey}x*|%LpvMYQ*Y# z17mkVncD*u@NMPFZt(T7Pq+;5RT@31^q_ExU^_zxxVS9F>c% z;t7~rz}Lmsa!X4Q#Tnka_N(G4G}E;6MKc6B%w8JK{rLe%IR2XD+7_=*MH_7Z79v`^ zFIxCRcc|1t#obZGEz1i{I>YeG>_!x{F9E9+ zZAxp6RZ}=#QIB3LC<3JBtC{bFqKD40H9%*KRLF~fl6|1L#KfJu&)PQ)VHPzk6{k^a z^zEuADj#`O+rXG_WsL#|7|p%c5i(|W2Q?Fb%0aJpJ>Mb!=(?F<%U_U4xrn4D0rD_*V;ZgZbD&On)R z-6VkukW?vl)Id+lRQ}r!ewUCpd<}1i#&F~)D(gK=sdTlrnHpl9>+F3+lr$% zS_WQnp^n>4DAN!-p*uJu;d>b|4ph% z#}=z_CZE>JkAV1PMFy&xZg5yRX_6Ok;b{`cov$6P0xN23>1k)=#zqENyqwKkI#;yR zcQ$AGfR?v!bt^KjJ}cUxjTY5!oTAQkX;Ryz1h7V{Xc&E|mh=T3rXOkqOj26L2x!#6 z&D}oI7L-x;n^X`J1og(~P@iQi*K;?^8X(XTVvz2tY5)9xcHEZybzM%?5>?8hDS&*m z(k!mOmIyNDVL(2^Dk0jw8ZZ5F7La~py-9GFJhZW*k(zF8^5WDeT%e%QEa&&{G})r1 z&N2+YkBF?kkxGmh8A{|WHSEVeG!oq9H>6h~3m6$p%euB-7yJXwuiKX!cg)E*72_X$ zubWrlupECoW4jfKvSM#D1L`5Khct*EOh!O$wyyd;jC#5&XC7%1nZMj^ z#hTolE{6gIj4DFCPkyQ2>N7L9 zZ?IQ0DW!~;^Il}LS^AEB^R}M0=KjvQ^tsMvNn}bL1?aLO7GqerPy5V$m%Es#x!Cj zQYClszHdpJ%-Ky{zjKa4(mQd&&0NfGV}^A>ImRw$8oRrNcIG1{murm12Fg;CDBo)u z^6G~mBgF&ba=gb5r~br#lBSNx?7&ExDJ7LhE?%~1sC4>gSz6rqm=j*)3FGf85#o#( zVU39=G~p;2jS$G?^TTrv@>`W>K%tHUbH^;f?c%Dc+XNY`lxR=D%+3y;CoF)V4oC)s zvMZaSE1l*qvX9z)$4mZ>Lx4?P|FVilI8KKs`=#89hPkuyJV$Pg)25UL9deVBA#FPd z%RRGoin;EGw}d3K)|9|YVN4`p49pDwSA~X#h8sNhNEjZ}MAd&sO}s8vS_=KXgWVCV z-%()3vY2Z(C1CE&_oZpgY5RhA6i%y&K4ECCVakq8-CnKuu8ljgS$QGbUopTMv?$)` zr)_f-bL1b{Yqvj5GzB@?bbSMsogM#>4Y;7!U7ryNkUn2TSS{YVCQff)6!tLCyzYjE z6=sXDB-&>A5xIw13e?SvkgTWjRZfo;QWqDF5hxAJ0aT|J++${k19<2jMSha3^YzWm zLH~4o_Cw0fe|w6OsB8C0*1>}%03(cVNv|1O;TGJc*c6;WYDKP#15R>rvFlqIwMDmU zlERJqTGNtm%&a+RL($of9`2-z@SptkvV(`4bwYps9NjP@r^4#H=_07O_m*YsbGwMN z0}25wrgy7Ku*qF7;h%kI;aYtaV9_FT#6#OU?mpe^03J4^Q+;KuaFeS8IKNt(wC}nl z#d8|?=#^o>IhrEtepVtn$q~ONo7Ic^F-M~4Hbt*4#`{6NOf0ZP#Ha0^3+Xjs8N6yD zws&@VG8?Nqs3ptwJNZR!Ew2*JS*EWdhJa_Yw^FdYIne&or`b3OKV3dB1k7tt3A2`? z)*ilX8GGG+BE>})*8yG%8fOo52!RVvz0a-|9}~4<9N<%)RT>xY!?;}7CAz#s+s2tF zw8Nt#g0{)jPZkbM7B0;Jbka)_{W&Yf?_j5H(`6iUi(bX?aRxJi_+y5Abt>CaJ2fdZ~ zno1-qW(QnRjzI=`V3t?O;(|GmSbIK!8%KbsH`3!q8y&S2xX}d5dD~r<{Dtd-+A*3? zy1jp+b!aBZ>yGq1K(7qC5k{oFBtCxK?r!sA4cnzc>9t02XwUf5~uuakMz<5`hrq zhdYnuQ;#$$I*c~APT^`-V)=|3zAM#ZK8Qi5dXOGll(GIOiHb&X3vxjc=Ao0D>Fs}G z#;1~%cB<1x&B>Y*naCao#UwUc&0eNkd;jUmKt?8jIj;P+TtO zpDhu6G8))HjVa=3W|x=Rw4MKh1J5?5g55+1PqHgDb-hzWEQylIs&GvDiGFizkQ%V& zmXZ4QrW8jx#8dMlrV0J1 zrJ*P?h6L2g<>*b9Pd5smu0XLuD47#?66m~#P|FrgK2obOP+c>gTqd0qzgBldCV{(F z6P{Q1V5!6p6FNt`#q6CWQ~lvmNU7qU)#8nWxgh+MzCB278+vfA({@kt$j(lkc*^YB zX#%YR+x`9{7SOs;r5vuFndpcXA?#3FSk}LtOk9Izmq|Ka_F4wSlWIk;^zM2t@hx2b z%vI4Zs|a3JV6B097%Lycb3MAbhY2?L4z;oyLSP?|R0d#ewr1v%Tq0961fZ7hYD_!Y zfP^eNp)+L6{%!x)EPn6wBvF>KwSnq6R;yEPn{9;G>n>1d5C1clcl=(jDhgUk;*XMw z)$wpxnFe_ImEp+DBye+J|5E)d2HLpigObHu>A?Z5q%{mCaXK>WlL?VMiE-mQMkGAK z!o!}+}X1>7gQ@8ZY+OC0KPP^xL_3KTuj`va7OiC<&AGEwQI-CMH{z?Bwc;l}4Sq z_8plqTY)*KdMCWRKjI{d7=vLQ3S(c*SB;YLcJu3biecj zEBcsuovsiXoyvf`#xSjuG_ZdQt(W-|UlwutN5krBAXlL|qHDN0)?_e&g8STON);6q zW+QGL4S zHqHv8@M8D&c7y>f1Wi|9c958?pKm0lWQO3=tlz>3xvdM{}S88Ym2qci1 z#)}?TS+YY)V;ff4E9c+eq;_GjMe2Zza#ZMb-}=U7Nk{m{_#j#X^x@+&+|zAlne*Ccd1n+_PolhcE!+BvySyn<;6 zj)8jLF)hk1b5ya9a%x`Cca@KGi=d2Di8RzFrS#kq*uUwTJL)DDp_7xT-7GsU zY9HdsqB3rB0jT&?2ewIGV1Y4dBRhjlload+EPjkV*1PO zYY#D}>q=Z)B)InL;Yq4t&RNof2jF&%W)8sXL7G#f6|m3kEp8F}!^l%Ra>n|Qo&S-e zolmbO488DSHM2#g(iC6LTuq*lHF~4vUSf=AiIDG!_~p)?$o?Rk zuAlbc!fGa6{G3~Da~u5S z%h!|WUPj>9IdHA(e)gI`qjGU?NvvRX#XrxxfyRp(wfS-fyX{0VRs2*)`RDsja&bSg zq+NWYde)Q+o_UWy8@wN7IUJ<7sx`Qu%bXBYWr^j6LOWWu>72*6{@O3$T(h$cx{0H# zR`~aM-u-c;2w~Uy{o3`@!;UC69{^MMB4K!|q@;xM_g6=yznT51f_M?e#TF~`wyI3DPvb;>F5oOr3p=X{iRIwWs;?;jv- z)~K`_%i$=F@+kAGzn;2(#OtVHI(y&#n{oO-gj)?D3|LENiO9)S5Q!TE(@Y?H%&aN_ z;n%uRR$fjcD46y4YXgw0tE-;A{s2jOa>sk;-HALH%;I0BSfad~oUOf(EW*h3VZ#lg zp=W65cDt2^jX3FR^yIv8kfD*$hzkk-e2*IB8xT;N_xKoqDReTSZ5$x=_sXoS<0AJ5 zhn}dNoA<92Cv(%Kb|2ZbT14PbNr5)#zmhkmg`w897i+Ap~z z<_)A16qEr^Cp!sejV{g2-ED*)J1y5=){3N;Xo2l!s$4S+m}#9iOvLjj!VXCSUr`#Idn`|HR{#M}6qF=1iVu>5?}zmCl}c-`^by=!y1 zJ=!6#mB5wZLIwMYK6&+9t86~@Jx7**y=!;SJ{k=y--?_3=5D%Wkff6vF;7nCw`E)? zFefd#2O@x!Lt7kr;#oewaOyJWMiNF?U!iMdaWO`vPFRsKbKl=Zi)5(!cAE)+EinGd z))fKJzT=5C#aGh>!`9F~VkfD(b;p|1mQthPMHp(s%2vI?8 zb&cE7^7225m34JAyu41^re<5!6sa`Mssv^_&EnQ%w9;u3{~rDUVZv2ZIKAicu5-km zC(9@(N>FFZjQ!|Eqs@&3MK8p$UbCc~g_nDL5}1!D8u;Jyqz{n<$r?QrEZFu#ZRZxa_ekO z>G)h^g)d)xvbK=BwH)rx$Ao+7BKcxmEw`eQ6aW{GG&Cq^)+Xv`-Fl#_{SX zwXUmuOWvvcIub-`3m<68OJwBfm99*ct5pp_eoNezGs;@zU~yrXt#SG#rbLZ(R>p-k zZ1woM;H zDHzrwK@y3DKO{+{w?|ANP8+Medfsu#s*OhvhlGrS-2Ra0#BIZIbaPftV)nk} z07zNj?SiqqPA5MSp*_qO4*^3zKfjldVT>Lfk{zDtx4Zq`xIVL{BZw2E>r$;H88xhp zH=Tw=^t`qasU$zl-a}W6OTAl{)neCDhHt18i(f}c`@~Op?)bTxU9X5Pug~;)T4H19 z{h?c{B(#2+%v#z#D%}g3U+>+>QAepQWOjDXBPb+zLkE>+QG<}H4x?I{@l$AZ_$80# z;*dW_7)ZjJAN4ZxA5=24Td1SLXNGW5GE^m_Ri3m-kG#Iu*Z~D`7H|WfDikT3oGf~9 z|2Z(>%h0%NHfkH*_hvA7J0+`Gxx1y$9H;$#dK~pb`E;?9){u>$9Q_x#i|7`{$+%2h z(h5YA=4}{xy|1U_T*dfvh4FcmQ60ll5SXqwZOAqM6&t3{8i9keNqFu*ImOO~2l6Z} zTU%WX`c1Ns1NbUejilV30d*WXhn|CCoMup`)8rmZXKJymOzY}?_!LB`AFph22I&^Z=OQtX>G(ldLM1ozPWy!3SNw<{%) zI9UrO3y{M=17IbJ^u({>(~w}wl)K8rkjoMM9u{PG^`lqU12Ri&*(U{#71QUE?^zR( zgd}+#^8IZ;jd2?G9J%>Tp0|u2sM)UWd3VWE(4NkM($kX`^xb6YTTRyhn`To#bcq6m z{JD?1Zf;Xx!vCvpn&J!|Kcs==ZHM5~fE?-6t5HWo{QrC}Wh;6OWQ{A+gVC};_U zlTq3PX~?ZKySexC#oBb+>1RYjqRSTL_bk5tazoX#vYw`q@G~_s?3-E!HH^I4=VsUm zsO1LQaXh=61bY2kC%#Rry5eQn)TZeJj2P|orjJRdzc{bX;+LFO8@R_P^_FFw^j?$; z@{ZnG@XB5z^?w=Z6TsIf$osfh zw$sz5TvEDVTG&$PuVmQ0D$d~5dfan;%K7E<_4Bie>`@yvzl>^>*RM^g_<-v~b{1@A zrNox*jEa?v7Y+kRr`5G-0}KpOT9r>^Z0I00<{*V&$xc%`#jJDRM!8H~FT8gaEYaR5>Xp^azH3;4s$_NpfYp+LR_3OeYY$G%jbf8x)fC$%9faBclmq>GpP)@#`?v-5dIu=gW z>mdN|bVshC?$xs_uhjt&F0u~{AiqA~Tx;4R=+PDyiL-dBEalsJvz6AQV-VYao@=C5 zxg%`G&k~mL*l}_Ay#L`~>_zW;gwrnCzkPZ(o8MYFM6V%m_O5#2R&3P0VjgMSa5w!+ zKd@2sEBC3D=DzKHc&!i?%DVzMBY=$PW`2)#uOdV8$NSaR<{`lew<5ZfBy^GH<|@|> z$6OdmkubEV>K*;>MJVyerWh>*zIfM_73moaFv;jMTj%T@3eMU?J|8UJPFN5JgeOO; zXEOLSez$z-ipjfs@@3^_hhO#UWygo@!n}hu(3*o@U2qbWR480?T5%!AF4IiYP4T$6 zj;k_%`$1P0?x>Df(Ww6E2nkEBnQE9tahl?$s5@{NlxRWa6#aXQuM9f2LDehXqJu z?w)th`B3pfcT%vs<4qW{r9ay^x~P z4gm|**|M|+FX{Ac$(m7h{@Ypoy=`I$PuAjZwK8>ml6G4zPM=nQt*eNjyCQdXW4BM6 zDqF_%nsaK3hjc*kq(A?$I%TLGtD#XP^)SDV5Ux8K{X)2NLyMG(x2 zB-&F&Pj~d4+PP1Lj>BNp`E{1CZEizMSHLj-=d-`dmPX^UTCN0>VLPhUjHadR{Ip6v zO=2v*D6^1>p`j>x(cz#$ds}x)rJixs&{wvy%*=fn%x3%@$V?~&xE~az6_<<|am3$X zKS(=Bo+Q036=dtTzgon4R*tj%vydI!8Qn_91M1l(8GD8H{4IBx>tRSnw?30m11p=N zFtEER5+k0g+F|fa!%Y$7+_jAJeqSi32~E&8bkZF-YX(kD|2UF0inT6XjxQ=4 zSJw0x&6F*urBQA~)bi{x<~a5&>2+YB^@rzgI%h^8`uy$qfzYa2`kkP19fH7BAh~1Z zt`n%-aaJQTYw`5zVi9fm;-FePkTEc*=41is`D(SWBaq?3*+!A6JEm@@BK$#gX~XYV zOvO6$k)A|AAS?d3FJlMGkxy%JwT-ut9y$|&RnS^0tL6CGPhzj|`byI%TP$4)`yfWX zqnC!SEtOt;y_b=@qAevWkBCxpa_X0Ivs5~i$eNq@Q8Z8uJRtaGb)B;4sy5FHV4RPy z)dWS8K8D&p$)AaS$Ia4qsvugFF92UBdyn=tD+w~>3kG?8qG>++#Kn}ES4%C#(%Y`B z5D+?CbTzNBZ*sJTvt1JUhjViPV4I@?#w=CdtYL$}o@7sDaC@orZCl-#u-`w*q`d{+ znK0AkvcKWLuYdBiqh~~l(~juTh_^}^zCa6y2GT4iq1T4|7G)kuR*xI@y}0_QCQiD< zX;T~VWL4GZ(}-VXzu$SNWJ4nnyZGBtwV0I5K3QW+nBg&Q^C~6l?&rf%9&vzR4{1D7 z?wU>`tp|6|l{;-JNkdAQdi%qu>e)pyO@|%9nmjbQrv+U1n}c9Ue_dm#763}TYM7f@ z{GCd;fA6%ec=*2I$zn17tzg8XhW<4@VEy)Qz~B!h!Xp9k`Cm2F<*7km=oL-uHk@^m zKzqx@MT0*0CwPsY@QyDTi}(YwT7|l0%qG*pIh23*WssJZ()#+i&YAuF{g!3{uv4-c zcVhPRUR}=3CK8b?TGKp|Fv@b zOqrF@KDsq#{y$FGgAHPrln7m~j3X;<-|iU8gE<`>=)g{%G-=ZgegSXZZoYMruw7tK zGbT;~JMo-YE_bGQRxey$*YOL}oOcd?5<=|18EPAH7ZK0^bEwudmj!>?_|9MwK1MjN zqrdlhd+uKI=^gx?wObmoYrDaFpcwveJ^C=u0e@~4$r05WJQnBll7^<)vKMP`afOD) zLu2+RzgWr-#mR8^@v$dRVm#63s~f_uU}S{Bk%#xVq_i|%lG0)@nHo}BdftsGdUFF! zHipOH2Chea{tVM0gTKbZ>E%){nM)fq7#&3XG7P9^)32h@sIM465ClX09Y68kjKc%K z6+O@5+vxwb{5;xZ>~D1QYxIAu;conI72f}O%?JD!FP@)+Il|WvkAd`ev-SFgj@QRe UdVI7uf4h{Nl(J-nxXHKw0?pnqkpKVy literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/10-luks-encryption.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/10-luks-encryption.png new file mode 100644 index 0000000000000000000000000000000000000000..3f277b7b3dc24703c1648e740448ba242df8b2ff GIT binary patch literal 62158 zcmd3OWmH^Evu@rHg1dWg2<{HSgS!O_?(QCf4DQYV!F>qsLvUwscXuCLE_u)T*8P9i zJ?GwkwR-n-)$XqDdg|%g6RxZ%jewH^PIw|x=?Dl8b+_7rHfT3d7#33nanTmsg6~4)ns)M>ymEP z-Ydz`GvzaF(FfM3e*F|k6~(xD%z_BUnG@siG%Gbj^d6Q_%Y3$FMgqgPWYTyTsA|8u%{l#IeupK2KuxLun%~ zEF|KVW=N1dH&#*HAb5l{qDG*gI`h(w>895yV-(>Y`R^~j&vp@HZs^8^@6qPpyPR*D z;;FC_jef~*Zv!;DWhy!R;?;w{6=R3_+xOF`EN^0{S59kpH7ilo!S2iB7t^Ey9-3t? z?+-A^4PMe;bNJ~Xp81h`YY*e9urQ@D?N=M_g|PoltFMK*FzF8MCfDol3d8jjL|@5p z@yh245r5nr$LP{%HhOT+_OEtaQ9a+S_QqB3rAne9EPVLCYS&vi6O%b|ApOR**{v?W zL9yZpqFzqoVljK6U4f&?c_cGGxk5tA#>Opk8C2I%U7GRqh8H{f#St#ddeq#+ZR`6m zF`c3A_Nw!fQH9NH?>{?d_@HWWU-PzY<%~u|;`|QfXIQP8Zeq4~e$%G)0Z}Wvo{mSD z8{3We!Mb=T@F$5{c18y)lkC?SQr^X?f#kYVf$8r-EWZ|b5_cGA5;2%DSqZdF(;lHK zlg|o*JTbF4XzQeP9q}UHJIna_0v_2XL-Li0Ap^O}Y=+iJw~dYSs+;0gbx3^@Qj06E zcB<|S$$*y{b@?ZH!+TAX`@PjQ+^aAV9HRG-Y)`YoG~z5$uGh{+cjA&OG+RFKV+Uk4 zZA?g@Rwlc!Sm@g7L<_C(u|NFVtvU6D?d^q@=HP*;hsDK8!1MJVgjXszIAOn|Mk43t zsYSLh0=|wfrxi=LFR70)tvgpPlnW-=Hx##D{8lEa_(v5X)bek8@jEf1Rz{2OLM$ox zeisl>cO06h4x9SaVj>M`wQ)+>ckZ~S``PqFr1`Y3V!V5`)ijku6p|W8Ea@O}eiqvp zBV%57{&dd}uHkpRTYn4EZlWRw#xRpL!+{KM^5F&+K+QH6%f9rP-qly%SN4M&s^|wA<#swp6 zl=C0eWk-LFZZ+2pzPW#t6pEaIFi*6A^6mW%WbL`3WiSeVI#Q8F?GK=iix%z7l1G5W zn*DRMoC^UQz;-Lg@qpjP!?*T18UlW58>350G(=YvPYvlx!CTW#8JX1#06*9A2*2(g znKS8r#?af=5>6g7^$C3#LA@LvWE-DeEceJKOPMN;Eh@r|kTAIX253Z5Pho z)3-63ScUWTKBrQFiY#5p@9r4sjCkt8c{nvfV8oJ;E=rlk*>dz{e}|xEzT`c3h#2lj z(GEK;+`AuSgopz2T`t$Y`g4U8-NE^#I)H(m6mLH(Y$xRoBYi?==-JDza$*ocB2XY_ zzahWXRmg2E`*^$wgU5a~+Dd&CT>*W_SPk&4JeEvlp^uc`hpEK?DNkl6dvGq0Ms`4- zpH^z*GVM{|Cd+o;NiL;=PKovqeMdwQjq%y`_1Dtm6j9S%lo)XcR(e=J75FO)B^*X! z6C?eq|Na$W)~g^vqtr~Uib9PsH%oHn)7B;L-jASB6l$SWX5$D)>1ypV_7+w<8 z;wAZAHP(GC6$fSe&Iu{9W>WH++)t^TiSeJTmu*WC%I2s3$uT7~H=Q=q@XH6u!3^;= zO_WKK2wY}Fl4+Hu_qdblWW20YSvfiJjEIuriw_7lc5!U@W9a0zW5DKOB_EVf|7|66 zE31&6FPrq7Hs&-y$zZR5hQ-?v+{*$sieQY_ z{(y?>Og}&4=JGxDONV^xs;ANLg)pA?ee&j|hl7Gd+j1dwdPW_6cJyM+&J%3pRB8%s z92#-If!D)=644+}YgztBePl=)9G)M%M|vX6yFX}vIV*y?5E@2CXRUg7_kG4dEH9y; zQGwXtwIthx3%jiB5lK!f%>~uw!o%^@N>p=a&CZ1P{T9;U@Zx6YT_p-@{*z|85ib6E zdO!|!6)sPw{%%{Z&LKwowLu|)kCub5E?OgQeh+q6*;O}QxVXwk;FWy7Gg}T>?XfQE zE6JC>m3e31^%_O#{LAg?5puJ+A2!|$=2SFBh&|bqIj0BpZ25R8qk~!~#Ka{_*U?9z z%^O^6r1mbK0)8YW)cy*=!!rwmD;MG8|ABqLcp9ldz)Y(aiN`U znQQZE_3|Tm2o36pPnsBgcom{77B?eGO`#*U->elRleyZuIy2|l)~%D>k6w(oN0H|^ z+vqn8DhUQmx;nF4fnscaZCp73F4eX!hbL1e^+Ul$4&~o8 zwwMd^LJ9{DGC~&#NhU@uOGQ>n(}*Z7$~XstGBvn9BRSC>6Ij}@vJAytT7QINDf-i$ z)E}}{mMHBF7p^m>o)e>=7B^xugQg%H;_=)3EXCVAO^*~SMEzm7RsDx-zR7@{yMjk= z4A#=_dNNN)<*uw)edmX?Vh-JsocG_`uYl%G^iQMQ| zBI1?733ws$IQ`|ZM-QY!3fc|q5yxAu?!>fRiIEnh!e~Eeaj*8nJcHPKBEGaaXGG7I zW>e?zv*a`bDHFr6Fng|H@G>E`Fn-?N&fh%eL`f3*2CDgGmF!{)@ z#aO7T4igjpb~3(WrLVI4wY9zx6BO2kLp#PY_AP_!PG)Bw5sfLSA32&yAG+Tx>P;P8 z!QrVV-koaU)vnkGz>v+4IqYa+MPy1+B)$=NZ%9nqAGaW9#&KY||9;AgI7ldq)aZU$ zwLefOAB6v@Op`}1lZa39v$CYD$;52XZuFinSrN3Hg#ZJZ8T+E&`-jIk$fPX|n?@>i;{b4Ak?@)MC$l_FB z)zW}yRQ$;dO}M!sRmAPM#Hm<+JRFxVOvtXPA{mOE%+_ zr{jBz5tg><^7!~xYaR9e6sG>`sjt?kGlABflRv3FP}Y$0bDr8*sqbM2`|{UF2^?$l z_f`xDchEw1&}dp(Vtuc?s&v!hTIuQzrn=ix5dJQjqme-*sJ4t{qkqH5Ho{zf>%bkE zZv-lR>swCX5;lTTtg7>#Vj*sa0Wq<^h%fpyQVz}F7TswcLJ~uwZcZ1wIl)`xrL9Cg z8Otk}ROSp6$m*SJ@seZ6;EvVFckXA{>{6PIVxrNTjffsuJ~>zJ_LPXAesnCc#TAO% za*PFNd)Rss?MERn3!n4aq1HA)uOd*lZko?1rfsZ#fiHOq%+P#D2bY&jTH0r{5(Jw6T{(@L*OV!G{yw-1~-R? zs~8mm>~%OdcUB%Y`y0Vu6~BY-Mwuyq3Ks3{+zKmuhBMIw=0}Uo`8Ib(XB#{sq$1Hp z=5wuT|KedxTPJ75CjEu{$>wxpD`O|@sRa?sn}k4Qix5;emfJ5uL-oF6#39X!R#%wq z1bL1v3OrxsV?u`HYBxtvV4~70d{>nflJ6`w;sW*6?gtG<&d zQ@Q@Vf6eM49ox5A7>-%%>}hXSe_s5%KT-X?)V zb_>qKBW|yIqIp9sRt0ODNAZfbwpl?TIS}c6Mn>H0Q|&tV)33EJR%$9H)VxxnE_rqx zOT?Az>@SWcu@FG09ya$17K6JTKLw`KiW9|NV{{uln1RQ>sfNL#Sp$2wHdDDV-Iyq2 z6+(q^P|*UDJR)l9SJ4s_rm7f_M4>dtgOQcdovQSWaLwzxLcdUlkFmJSd#?^;04U#k zjws-1m|&^d=RaIParCyao|RyHU(*xL9FBkw zYI}e>R|}(sTGmrWdaLUOiX04{B&h@SBQY(4g#=3;XQih<+eO`Q#oRP;S;>U{F5jhr zN&kdWC_63=_F9q{^9-Nqu}u|?>Uc1NyVG1+GhB=oHzQEstdkSh{mvEBh;|Ef>ToW{d5I37ddt1JE>(^De|EscfyF`KD1k_6%+0K zeFgaCeEk>dXbk!rufYr>GJSi85(B5zG%vsH7(#5nQx*cq6jh~wOb-mNh(p}GfXM_{`vdf%? z`h!rzVsF7CZb4=^NIp+M*P*k{d@+wNs9xy!MU(<`@Q55mhKH|-hYvCT{ipsPMGtuA zR`T?}inZSJ^Ds^uaksQzpEnVQ>n>P>`4b6@YVHbWZZKcRE7AkYxhiAgiq}lstm!(M z7w9)1-=})=E+<9N=^Ay7%L!1Xnj(WnIM}Vg_oaIe%zhGf;{d2fcRa$|;Ep@Lf~9t= zAUH-ZhO(ArLOLAqYug+r&aGUKQTTh@y>&E$z0Weeu*4G6kg#lp&#-nPI1Q#T;l21S z2lN;HpHP+xumoS5T*lvVal8%p?uU^&p|28GL1&3D zbtX*O6+Oeo_r$i}TC>0D2TivN*KGbvN4=98k>VA|LCdEgmWCgDc#9ctJ799;sbM!H zIPUfp@crLjj^x-M{yus4^JDOTnfdAc#=q3hr?4-)|MEKU6zF6B)dl|lZWqkS$w|P! zBY$y(H>$n=ub2G*w?F%@N&jtn|HoeN|45O@FGne@;L2+3g!C9vMJODaR=X-}6~w3LU=3n1DJb zfODw10J(Qps7Ir)R#%R9Mc&bJ+vn8+F1dffN z-)&*FiEQ3vcz{dlPTrwOKt-VI-%&s0FfaoBiuGFhlti9>2kpHEb;{8hYEWE=aC4n5 zYE&XkmjH*hS{4}BqD8eTyv^0wr`(7u?Wfs#4w|XMU+SX_pvyMqD_M}!Qx|fB(@=m^ zAE%qTmdAB^7P6DNn7Wu4C)(cwrF<~2|% z;AcBL+~H@IIEu2JMbZXoyf&rsh3|-~+ zt*lg@)6?@aBB%QxB@p45?xH?q^|jn1v{g;A7p?taSM9|w)AI=H_PFF_%c+)E$j@^+ zCi-^me7V}ijGbSJw0B%|;qU1HFS{nU6GeCa6vXEIA|x(Y{FFOqFkRJrlqH2Hw9$w6 zdbPiNpvUzXDgqWysRHiCphhBbo%%mR3H24YRLqY!IPxZ4 zw4RTf0pZ4&lpZIcmuRtP`{K1j;lL?+2wR$8zp&@tly%<|AX_{6D>8a&#pm!vkUD?X z+XHVBzRVadOx<7No59x!C>=ibOl&cx3!!Fb$KLJn`-#|SkfN&UY6zD%*xWb_b?4s3 zY%}-++q0)3^web6Yz}jVQ|h5*Z&m-6*m*yU&=gutlH=d>d^cbE*XPkW!8vbP{mubg z*o$yai8-S#l-Ns!Rvd`l`-NnH%qgtH%UJSli{yY>4(9DQ*Q5gvTye%qP?VNKpR@vR zX4H>Y{Z4=WC^}gp7*46A;^)cF>k%Xk>O@D&`9>}C70bor+RwrwRH1X>u1cEBGq>+& z6Uk=sa5jY+4T~(f`KQ9ELjHywwYtMTGmok^Y57kr=3d>;2~j1>bfoz~Irkm9IiiaCK5o$J6@dmVbz(I|3>t}@4!^5P zALn!|;lXu3xLejt&6^_uO^kg#D(+=L!KjV14Kq4>U%RQuxd>Wdl&F2+l-JD=42`&i z;x?hk(0N804BzNX^;Y_kdwYTb*mh>}zWE@y=%2 zgHz}(k^7@A!uw_}Ch~1&UvExMW=;Z+yU=M<7+X)$wM6`Hn>CytOgT*HQdVl+dDE>J z3|@Co=BOA{wVnzW*`7EbP=WgJD%F|C)?Wcrd@_5*bhoE)fW-7#r>k0z$^pe_ChzaH z_R}N!E#R2=j{LA+T;>kvc@b06KeIsj;vU>?&DYVbBHkO}a1J_rA`FiYhNpz5D`rwV z=zcl>M&C}FJAd*&GagU*A}_~%y?hb#(>9tS4-XSxWFuu+!Y}u7YB$W)w~fPaRJsF8 zoQ4@3Y)e)64mN}9=x8#`_PTH(YZx*H73sP_$BE%Wjxg~2A91x_B9;!9UlW^~lGIdD zGF}gdEB)RuXav+~&&RWRrvn^$o4PqoTn?T9SM}r5PdDjJp52KZE!C#3dG*&^v-`x9 z0i7%qZ?pKWldkF1MJkoWXEVJ%Dnq|D++c);M1_ISEm4OZwi(Dzf+09CLNVCxbP`?C zeaz{hp2K}4-6B1ey3$^@nQXmUL+jrt8)cq8wLHhu#=mKk<9RA`@sGt=bR%=?-A)T| zH~wTZ)wapasvlSXK?w59=wSO}Qlssn>n0)K?yQJh=Vqi~8D;Cu2FurT7NS966Mk{Q zfD`dyQvdz*)x$puV`1=_1~s-#;Qjq_0u6(|@afAqd_(3qd!BQZe#7yiZVo=rvg`5G z$#&LR7717MqHg{G1Al&s5OkA$^VLVB&1SR~N4Jb@1ZjESX2ylAisEIhl-gNsnsLou zW39ASAJDIEZb(+-DIHoRv#~0vG!tMgzRAX(5`H6OvOTo;N8_i2uY_ zcL9D^66r=kpMHIaCh+x0{UIY7&7fl+v<7Z(-&6;TNifeYFR8Q#4EL>7beLa2r2JdM z=T%y>pAV`G*4oNj+9AI7&K7G25oiIm{?Ajb8l8^N&wpK|59xmcO2B&Sr@w9Q*5Q!< zr|xXGeb6lGes7ym6R5aeXZ<=ixzya1a4POtz*dws80@0ENscpS@jo&rQ%Gycqtd@2 zX$P;7wV2w=sMzDXuVTqdDh^`8qQ(4tvsxZ6)Ep*+Vfb4Du@uTvh``5dAr#sAF|N)M zQUJI;*0^(GCwF-A3h{Tgkel_=c@AtLh1PSa8j~i=1y6Kp6DxzfzDt>%^2%`yUmIPR z@_a-EV@R%%VXWKYk!0);-GJ!HBVk>G3ru^=r{$LNx9gBNuDqp+A?;x#k`@#wlbnYP+YobXCZWaLFs*i{zsjS&J=5G-$LO9r3`L=)x?# znvxegHI;dXZK;Br1tXx#Q$F=Rs{5#i>%`o(-Z`Ucx3ZOegT^ig;crly;`Z6F{b0{l zLi9j|l;72q))#6bCaG9Dp6fEvEYCkW>(&&jl_2XNI5WOS=r6nV3vu{@_di?!p!z@_ zQN`I(WQJp(YFE@~2)lHl=C|@T{&)#f8y%>qC=bHjBDT#+6iTO}irNlY&tvs6vQ#eZ zG&LeFS~SmR?GBM|tnZJ)A_?G|gRjSN^TX{?92t`7LJ7hL$o20J%$D0$&OMeZZsAJv zEm2DvA#Gh^nyGT{Iw8Be)$>?Z*cX}FD@IjT7tKZ`LYv#@rd_OKCy#r(oUc^V^^0Sy z~(fF|0l$C3Q z&+k3;@KC%t#is z>GGy04NlleAiq5th<3p_H*i*(3X=tmnzs1UOe7i|QF-Ndt*gPvvS~U{!6}UkI(o9Q zJx1BW<$}H2=O@d-#cBaFw#%As()hD4afg~Ak1uVwNb8V(0&|Z3^3TUNhqxopcy^SU zt?m&knk#ES4uGho5t9}+o9Bc+o#usHNJYyEOCC|?h}l{>X&RR`7rCP&8lZw9r`mQ zlr7nfOM29xfv#B|qnLxITpwTLbNiQw79xhs$~53tD`MMm5q^age;um@t2evDW=SvIulkPYn2gn=Mi9e2I7!uE~ePI*%`=2+o| zB@CYH`bKzZHyg}$;DOG9ytti0{?M?Df+Evs7wQb18{VUa(8a6*H@E$v4QOv?n@Wyp zbasE5ml=b?f<4{H*UGv2r&m#P(dv5MC3c|>riaoISju>ZiXi+TWR;%+UXdG^mMy!7 za1k1z=Dj&1FAt$p>|-FTH$kj+HFDQ%nO=0;OmauRNWcy+95gT{&gxs2NsUNzub@4|Lw zv|lBa${%oQyY-cVnk`&m$du=X$ZzMO6t2S^ZSX5Xg$7kun zU*V@O)Q**{zEhvY)*6;TK$L$K;@a40U5)aMjyP|qcOAZ)jyw9k?JyCKY|T?Oia)+^X=6Y0;+}!Fv8pnP&QdKFb zFK$qBaBg}E(STzMmP@zg!HLcg7Gi9WiX=jG zvV0eeg(dVuvxfQ(36+KB5W%rer_cQi{(8)#+@g}k5+kqy9bz{I#>d$yU^qBqTN~tvY`?K^=;tD zcIiDxIdi2Qm!|C0WckH<*;z+3$AE2?&1Z^p!Xpj_-imG|qeZgDPN zNV99_f_zHxrKlTzDoU@`296wc>8tg7yhTK<=7qD_YfQ5!Zfdm@JgnjTawz3m6&@R$ zFMM&>py%f6OIKR%bvVq=C2Rca&v}KIA8Te8!yJ?&2G>9F=WWut@~H4<*mF_*=6&#r zyu!?llk&}1ixbf?&b39xpik5WjeZvkpHS`TgUcl0E?XdCh@TAmF~4^nFuY0Q<`R+- zhDJ<3L0kS+fi1_H_qAmtUaM=1x(L%bJmf)+M`HiGS{tr!pEbRKv8IK`r+C0`m*Q!* z;0Qf>Nejo|-X0m0t;a9zsBXRgaJ6`nroO0`^YQbwBRdF+WlQY4H4%$@UrK?zim&etu?Q2zDOGDdu7xkWiBSQgzMJYt_r=ya*Wculs4^_vqZ8Zu3mEG$G-Uosm~*O?rzVVe-i6 zA*Gu>s*bl+URT6>(1cwwH|l7;eh>L_R)MmC>LhR;^`ok@N+^*^Est5deus;je!ceR?%Zn<0`w2HI4PSxBgCO*cL-O7$ zLicj|7-Mg1UWpn)FR`7Wye}4##Buqt__w4Afr=RSTaD(qIJ-|W$19)37pqTjQ_gcd&{ICL^AMl(JE>zXYm0_OmVZ+x zieGf`e(3@%wO0>vg?SJPnr}cW$_XIj4QWNrK2*&fYj96n6L+s&f6SB~ph0vq{ZNOB z>TM?Rg%ibN)5$myYnV^_dx-i8%F32fqszg=bVJ4U5pDrx9=}_S#)38gGqH+Z&K#2@ zIuyL+=7*(^^2I3PDKToKpb=C?pdU9^WLLFARkVj~YLb?!twE%ijVx^>P5Zg00TiTf zp2s}DvdBCp!yHyis+wU@5;-d8ibh&>g==1DAZ{fzx#&_dmK>i}O_3~f+Y)Na9n|7C z9<{t14oD0OHZ`}vOA4j%RbKKhfVQb^>V+=0e3Udc*0E~oFj+JwIOa2J;2*@owxnF&}I9(Mm>C=kw)Z1_K)5c%h4>5|^>pAfJe0 zU)ZSa6dEc5jE1OeiE;{dkybfM0|E2gTd0LMCb#7#(^p|N5;dT(7IB+==RtUv`^mu} zUcOXlro=t>3^s(Rm4?>3$?&JUxDA#EEHER##g8qs}pcx|~Pz+%=vRPbbXCWK9t zb7(XwiCvPS|FJ6FT4b`&ws`}@qy8N9R|%FnVRX2;g1qxnj)*@K3vk{|$ibmuonN6p1yziHkYMTE;aDmgt5YyGXV8#oiEyNUnOL5fUij__C9Cr(Gu)O2M1$gW5(5K zJ#j)l?hea$+=+wd-a>1>S6mqD*byH#b%|jqZA@0m(fnQj#j%_Wlen}Hi30$E7+$ZO z?$Tn5Zn9bwcdr3oO$_iqTmZ^P4loW4K+US=GgONB))C*8!uJ$H&~oo2?EUZb_=BYxDdf+ORZ~J_1O%s6eF;KJ zMDw1w(^KZ!g`SOILSz`}SW?{Zo{*4Ui(>Ypn>W6EFZ-0Anp7ppd1~rPvnWw3TPHTh z6FT#dm~5`4a(_hRk}pk5U2HUGLe}A`cRs~33yR`*5Fhmu$gaBE{&5;b8ZrcHC5L$C z#VHgBKyGamd2*Cqf65-On?DNp=KrX=G4C=1$Pg|+{mSqP0nkqp94AH=z@PbE2AZ^@ zHUY5=@wlM|SwGaKEQ^XGrK4kS!L2(7F!YcP;kJCeXn;S|Wd-U`_3Z~?&dUUte|Ujy zL2eBUy)eG&Z}e}gb~nZ6IV?7;FbE}lb<{QKT(X&?`kvZ^;~@l%i}K#6#K*6hNn;G6 zDPJ%Z*l|v#?i&fmRuQ8avS>2Dt>!T(7g^XYD3(D2L0axX*TH8st?qKVC6AmH$%#L70R^%)J&z{gH@pSa&v2FgFm4}}<>p4p2pzgOw=?yV=H&|Z9_ zaIM)z7(Yj+uil5EPOa9{YM_m_ZawG-%G`(vMvW8)I6Z6m5E3gAzs0tS^khfPrr(_O zvZ5VP>AH-&U~u-t1~Ok|+W;3!($lwX!TVD%kG}!=(|U_4n^(fnNQ{Ytp zM!6DvJPAQ@Z>lyaM&LqKfD}9vJq>wPTkzfcY{%fp#qt&~$(j3j6^nLgQRG;naFf?@ z3jZkl1>y_%=0153oT=}pHfF}J8&6!>v_8rnmYt6!^c+gw4|Tyz$Jbn_EIXK?3hz$C za&_0WiFrQosQlTA+kWY;UIIEZEu7k+n*HF{_+B8wuEc8jZh1qbeZc2_A=s*a-|CaQ zt+V_lwt)M=Pfjn}Pzyq#-fWH>O$Pyb!`I@0K?*!38UNdxpCj;`Sc0Kh^=Gf0DR+-~ zy0|VXOX;EBjal#q`wET;_lnM`z@b?BQI=2WYwHQ|?def1b}i%Hi`k`2mDl z8yJ6{869FN-CJH&&w2E_q>wuHl}%aL$=%ocup)B$8B|^NO!7` zz5yZBZ<)nbs-Y`Ac=aS=WA8A z++01>1BZ-^wWVkB=+$$j{mRP}R(%e7afL&6#*NxsQhHnU@LZJ_y1H`tnt^EO8#tmm zyX6xArMTG#>>!XxC{(jhpd4vrs7&PH1@xBtxUCUoKDZ^hr&DOQ*2TWJ(>OX zIr>JZEO!&b6vpxT=ci;0=n8kk{uLUiU`HI@Z9W}3P^&)!IN3kv;R?fiocyVKhjQji z)Bf7+X-t3m&=(+N+v+YY`m@w!YmxaI&FHvEZKh?o(r#sYyb@6dQ>Cu|#O(O`&RC-1 zYvXaAX<2K(h{ivo$_}*xwAt3!EV%XO8Q5>Y@P`f;!`f=ZH5G2gVS`2>@h;R`fS>;( z99(#eB4Kn&R@RAoYimo(IIOk?A!ShG7hy>cc#Mv+BWLG;^dbTF&f10|n2+A>q8a%5 z-$jQ&sI(4&#;zEljq6a|32|Ky79Hp#QHZO{TDhW2BHwKS$a(NhInw_8jnWjrul_9gzBiP=- z?Os>(+*3$+JD-wi_gGw*WmFF7LPgNv>_fgWkj}_b4O$M#&73R7D*&KEmP?oJw?WUB z32OmZv{c#8N1&{{85_(f-JIq6#Q4V}hZ@9QPX_=%{90A11`#B@l1?<+cIS)@$7f@> zd?^)uosE`Kmr_A=kS4G9n^f7WX(>UZ34lQd0;YnhhxoF{LBYiu~&Sr|GJ2|?_eu|rTc7`_i5Csd=m<*PVd^4Y*grn4f zR-QfQHRo3FdR&%~(=dK2`sdw`1x|(yMtQ~pg#`!6>A^c+VHF|)_hbCfETY=n+|C_m z1uv2x*qX1yqQV|bR!d$dw&jtVBtPi*|QJjN!e5q9LZiUKr&!xdg8_adwK z23QwChRbcC72Rn{FTPv#BD8=IW}Ta=xha+>XuyJQps&5q=mT{xmZZll2NOU%F4ju! z*Ii0Y#p}5dPw?-={+KcP?AxcKHndecUz3#$4&=NVjhCrb%wQ6xM~!%%j<{rnnlQO*82#iraglyf7`Joh?}DGdsbBRGFOb-|f3XVz8bV zICo-jBAbL=a|?D(530CB@XS&1@h6GFWe)|GP75EVnwHeh3d)|)2>3GbmaD12)31Q@ zzUg~I(n^rWm=eXy`s>D_1E|^Q!gvgIj}gcNACIYbqdyJ9Fg4{00m_l z-R5A@t_IT#^mHEI__OFi5T^4SO*jR9*(s@qeUB*;wL5!tImW*j62XF)6u`Y>CmCL& zU{24=ZP};K=*2+K+Y$_u0&k%AzJcKNstay9Hz@QN(j40pY;U zMK(RARH`VVWPAYWb~M}U_i*U0;t#TQ?*TFVRHG}&p6t)cBe*(r_^k*cr255RitG8Z zq*j!##$vUe-M0Dcr}c*89-jiY2YawiJSpnYTkUJ8^&P7)*KB*uAOR|&Bl=Zq4Sq)! zQPcN(AsinUOgvAOQUS{d$jE%Of_umcj$;HZal@;K+qLENhb;cs`~xOif`PK2_@d5bV$zG1mZtT^=$V}59bOJBx50^PoQV~s4d;;HzV`g`c?>#q}s>bg2vD*E+rBN~DoA4^59i&gL)Z z_|g55-+3YX`m+chy~ka<7N!MKASUEPuwCi-KCxUk-p%OEJE%o%tTkIZ{u-ifPi>`r zSuW;PXY)4z(5|>9(tXUAYFN@9?2!Of@O{W)ssTuX;4M6-Xc_SKI$K>Hahx?}Yl92# zvqBX*Ktc(80Wb4Q42r+uCHg2edwN$?;7rD~yIqQEDCkZNE}t6W`8=0tcp^5=-!BbY zAW@SB4PvE53={jS8B6TDD%QgzW-iaXr8t@9)Ign4O`bV%aWy}}cg6HLT!`^_^a!+f|FDqTqqYi5icTcqz{A`#J;*~k|vj>~9 z#Sf}I!3WhYQ!(ug(iYl7t&Y86o#*6B}4WRy)oz7L&5`M@bifr%^SW)m> z{0y9GHE=p4v0-0=74sRu=K15&Xx)16oJSPDi(Yg|z$r}Wk$p2jo@t8UQ}%9~mE_(H zVC1y>9DwzeYV}YWm4y2Cy+#w&RUmcxDaQj=K*{qiT2{F3<^(KTb1BiL>RPE5v`J+b z7B6r>7C$2|;?zwb%!^`qLs+-ITLJZifQ6z}b|sXQhbf5LIzZVq)6Fu?R{NZV^#MC;*R(Q`##sK$g3L>2 zPWl@U$?D904u(o^>4Xj~DKA1Q8m;?^DMZoY?dw`v;Ulp*7JuKLrc#(iy@mX(9;B>s zu&jBF_G%)PbmZRV5XIJ~O8iQ3$t9lzlgvZVap=|znS=Gg_y%*be^vI%M{ zDV+O7SvA82i&$;0ueLS5jU!>~L+ceSWWWWzNvD}3Ve!9N*6VbDaHQzrK- zX}5%sMH$+?2py{K90HO~QpEb#1WWwH2y#R@vEF*_$2+%k;C-FbnY2Y1VRE~);k~nT zZ4gPOL_S-Z;5M3SB9k#OO*GL)^))XHUldMvr}wor7Qu1Z+P+rK%7?_}%aFEQV%`66 z0S&vFx^vRekEj!vLrwWEw2fa#ZTMZb-o!Tr23|@h=m6{vuzf^jFyL0H_5}Ed1AAUTwgRUi&o`ItfJ5kDCpT&sx ze%4~q3O;la_P!y1!MY1-zx7r1gIi&ANqI|rmoWlNJ+A*N zUM^ZPBf}XN+$9fsLaB-=zyBLB8HP-;(Yg@Nk>`8*jl>Tj-aDmFZ(xxT(u( zZ5~@fuhrjv?-M)qe9+&BI+oTFx;tI%Fz{)DjD&qfH(lvCp15{O1;+62MKNnXbh#nr zvGNZ+?M#WY2;I-tcjK8SXhr`D4*y8exl9zS8=%<6oM>3d2aU0_R4v}c_f1?`obxTQ zJ4;2CsdC%?EWS0?z5Tl2BY%^Xu*Bm?i$X8&e<1!8jdte8{gWxm$R!aUwPx~g-+ybn zeE12cz;ZBFBr5#7>dIWdj6sz@bB*`$OvVSeiA=BcIf+zi8oDs;>#C?p(>w#}&u#y- z*B=kVY|muOjfezbY*nkxMc%A5ybi9#Y1s(-Doq}u)C)K)wRQ(n!TJt4*FF`u9?)_fhU-of+9(cA0zc9l~a?z;{C!c77Z`tqMs!(Z3srHmT# ze8m#3y&Vk67%f_Rec`#dh(KvvBP9_MZQP}OU8!?;D+>hCcWi`aj-$yCt-g*>DiP0v zExIgNGr@9{jnO&W=h8_Rk4oHiv5erPYpy_Etse>trTol+pllHYH+DJ&dn<2;0zewaqi za;_$xGj?q+EMOOK-aM9qg%Eyh%|3$(HK+Vh9%AZIErz#PE^5rLJ5hR>g00o`?$( z+ZRKWJFEsu2|IWTW@AQjJn71J@?tAeJc!o#u>3aZSoQf z#|}f&Ai=xuDQ|xX;lc;Z0bi&bzeXx{neK@Uo7UJj@63*gT39#zQOx;dAyGY*#}RyR zK(G%eSju0zzHCi==0$56H$cIhT8MzG&SO8m8Yj@MAtDN7BtJT2Gqjao%c>DaPcCs@3 zX{UORr@h5^6%zqAW{c%G%ENIfI}5UU6+9;}GZQ8X)?%?{NJ(Xm`4vjeiZZoYO|JWT zrL3~RPezFon2x(C*dA~j;NW*|ca~KA<^8)qJO7Khw+w2#i@rvAN=tEfcXxMMg0wir z-QC^EgS)$?xI-bh7T4ge#T|-!xOv`t|8u|JdEc4)Ey+xNbI#exIcKlE*4jn0*5GTA zK5|EWPQPIh1YEMQEhk&P0x9db1doI=dLpJg!;1_9Z5{Vi zx8ZY|1FrWJ6OPogkCh44{q9_wO-1VQt|VbII7;?9Bg)%9$H1VM)=9zpKp`FZli!EP z-%w;hrz7BWO``jpBEa^WCEUN4BWK|}!E5{Ct!73J1~rswGKb)D#*dZO_#lH_E^;-^ z_iY#}?)v$2>v%xD8)A5uuZO)fX8SAIsp~cfD1Ek+9n9-TxD*lDCHE9$_|4_`FAr6G zc=tUAh40zE*88PihF|z)B^n%@T4oK(2l`Y#fx6rFPopcx+dq<2s3j#t5o!Xz6ggGd z314eSpKqsF)B8X8-JL8)Q}U9CG*=6{EHvq~>C7Zy2f|8qK-8TRcNx2jrEJ?1Kd-Y& z3Fk&M7+~miA%bQFD@4J}FKnF)G5&k;{}0!f|1T9NPF_1k1s!$M_Sj*I*@}_VU+A{H z0dck=kQnQ}c{^~i!roD(h|lc5DX`LO9V7->x^^=>W%#c4_pQB&db1?GCC@SLUN2et zR|hk{jMZ(jCe(I8xg;z))Ekbzeb>xJ13m*?oIuBq1+461a6cMQr++FdF3SPXP^lqmpl-iHPMHSwc-YgS?o7ZXEVj5c*Nh6Hpc zlzOfPJLKd++{-VgqsV;q7?^<6ZeBniZGJx*gA%_xXoDSDgsY4)!i%4O7d^+pSY>Xu zg#XdX6S{fRKQQ`fpSu*epW0#Pt6(J%%$}u}%04{uDNlIeCoR6xw)q}jvFo&o5hUL; zN3iQBjP-7 zs`;!b&nYX3{b5I)M~qp{ufpDB{HH$`-kqjTelr*_5Gxap69rD-d=I;gl6BML+c5uG z5L42ZbR@fty^9kw_&E&$h+M>3!cFC7Zp0)t5p|CuZcd{~Y}Vl8s^j_GC2W4bz3e@itunQfatElc!{z5T zoeQVVXv0;H{K?m1luy_4`_c~>`y&7D65C76Ps^r8Sd;3wC^g`sj4PztyjoB-e@kMc zmbpT|=OtAq&Xs~oE>16zmlRT6;qq;$mhSBfBW0FEcj&*6>2mX4;LP?q6aEvPogFT| z^hqn4JvG{U?~$EAri>?S06Bj~i8pJhR5NETr9Tp>*q%+NqEB!Jo4k!4p~+G(Ckoeu zkSIhyG7_}?!zNSLhOomhzqb|uqiRO~`pL)=AD=l<5zHo{aFS3g^=&YdP>+6}FB|QU z;68Jx zAXkz$%&>8u<}PI)j8&S{`=Rm$DxVP^uUnx~Af-^7Rn#JnbJXgl*Az!g@)XIC)DU%; zY08wfnJB-tZ1tC;&u+%6DQooKew^>Gqr)P5bs=2REEKQ5T@j_#K!G55%Ln}o>j-;CDU;c%Tm+GJEF%~PWM!r zQ?cdl82OZVMiTzU8oZ{T9L1#2WZ7*D;O3~S9trIOv&FK z3uDS+F>ISUS5m1x+Aoa8+*!PZ zM|{WLhenv3qFuxL7+ko*S^X-M#wynC?LCB{9Z}t?*R(twI*%kcWsC~GlndLFzcJUV z?ZsCXCee3)wMp9e#xkbTKw{_YChuL7caIV@49oRW`cg+nB=d$VHP-%8=@<3)7eix9 z)Uz4J6xj1*BxsYcVq#F-xTK-UIWjzdwpbCAnQ81`fm}Ru_j$Q(4rSz5W5k(5Gt+{n zaQ&&mU55Pzmh?>6ckamApPOpbG4^f8PjN}k}^4*&^)V&jF8&`1B7#&YCAJ?TiRxr0)E z3-63sw?|H@f6Y+-5rruP>_wxi`0=hA7DcbjW?L}(RWkAkz7d0WS0Lj?_GWR zl+|A)C-r5_$8KS%+=H@IW#a$VYRQ1zzWyt}RC2acGF*RrJs|2sEpFalAw`6SmS0&7 zR@lvkdoWgZps3@GmL;HPXI5*~w-!|PsUfQ|fIg=z6+1fNT3UpgY;y@!6*@-{pxlO0 z=aiPRs1Wu)a#hetwf2))evUt~&j->2EKf5x#bHdQiXbXOStmcY7@u{#9PL)Az01Hm z^cDLcwZ%wB4f1-?W~tuO86x^h>+MCuIHB*oMci*?Lqxnmj^B~h2nkvz=k_@}KD-3? z?fuFc@Er-&uYvG7YGwKn^CjDvE9CRC>l&1a);XnM(Wmji-+))b4`mNw)u91@ClbNXGLFdK)JmxTSEsw>m3?uIMzJrC?xd8M#CfbZ7H-ZQq&%V61Hk&!U z9;ICeB>f`+lSeokho}NA^XkMh7j8qvxj+z){?gp$S@O5AK2G2a#Eb{?bh?l$;oOGI zW0I&)Z&E@he=;WRv4g59?q$;8jwoF(G39r$>`31-LXAVP;$PicVgRW!so;yE*$YOyvJptMU10D+o+`iEycm~ zC$OZ07@%+bhw^n1RSB)6@QbMEdbWs%f3d5ej>{F|njSe@By6ks~k3 zn#alRUSc99g8Y|3LVkG($^4k?wPZT^xmoTXYHBGdYSPqLAK?DAnLfR%seyzJ4TX34 zc@?b)+@$gBwDPAC1n_66avi{mIwNv8^zI7iPkHoo) z@GxJ2-)B_1nW?F~yeO8uxpA+BZ3Ojyl)$h`9iWj@N(9H-|NfUVY0|fkUfG}ECh~)V zf^?p1up(7p`v)A{|0XL=b9x}vACaA#P;Z2!sl)z{j2{DOk^ikwVWd)L4twN4)-T#wJD`}a5e0|NuYUvK~0eq;U|T|JRa|C^eC zm;0hW&YwbgqV-~gh;0CA0}>M}k}egA7+yb)Bh!ve(gZ&Vv;t7D;Qok8(HG4GzrlrT ze@6~G@$?H81x5MfH(GmrEd+CpW?}EABZ(2>>2y&k8Z@RrVjYH;HONpu{>F1Wo*i`R zyi&e}2MkOH2X_Vs3y}N&P1@*qD5S(Z+m0>qtLnJl_@?PaxF&}SnMA)#+8jZ7S3?Yo zz{H(`%Oq6g0catbYIGT5AZtFbH>Fy%y6xt<7KoUuXPs@x^lllNp{+2In{E{NBh>n1 zi2lX7g_p4pObiA8ap>Uk3;B62?6|dSun~~ZMZ#rG0JVjK4gyF35)CqB08;9l5IgN0k`r9)+q&o;Xm;-{Cp;d=U)%%WZ% z%L)4u@5l?tiVo0md#V{!D-!TLUB%LeWpKZ%g^@=OeZ93}a_6P#13Lyl^QIE=D`~7c z-uAUxQZVAXpJ-N4Ar$&9*x0y7pIN>6CBCs()i|)ZAvn$G^1A-h&hO{E3yo~)NqdFi z(|JTVE-r;c17~HO;tX`5E81Xr!YsPDL?uxgU^DR(&A|I7PT_yT{3VQ#_mICJ!-E}n z9-0IG%r9+`mupqU0t8JF&94X6*9Z4UvC@YGj9xoefWnb?cP^K0`53m%%>L6{~X;nq1dst?)@W<_U5w9himnHspW)i z@0&V(MnBHA845vl7K0TQJZk^>sLuL22}KW0mOx;0|D9_ri^4>g<^Hw1&<}@zr!M$a zB;BaX-yd_{#gK-^bc~EHFW+;q0rTB(;Z4X2d-F;aXig`V-lL&sV{VDgkmAh?9z4Hz9fYInd;$kBC z!_hGoQ$j7ESk+EKAiDn9*n&XZliO~t8Dnd8Wxi%Gtl~RSy+V<$kNI50B^kLhh-7%q zzc@ZO!9c@DDh||R9aQKX*z3QuwX-gDf#=-Jl15C8dMJe~26H^((E+5A@0arU3tdeD z-xI`Bd7gx<;3MAOT9i`<;8j;>B#g+F=S%ufE?plyUE<@HVpr(w`vSTPxAh9^Je-u01E05Em7F0i@yHahMVd5u+yb# zoUIaJeOuej8^!Bj+je!7<(T3KE1N=cD;ngpIMC0ois+vo(|k!%I;R}Kw-n7X3*$`& zV6m@t5j96(xr#|Z&cTL@+%N8_$Bgraw6+lOy8c5qm-%-Nk;Q9EjSXBL+Uv=06%&W= zTjdQph${g?jkX2x@0~c4Hr|$28REy8R9ZhM@DMc*?s4$Q zlm=pTUX~#@)Zr3P#}0U`nuC>9{93VJEqqRZ$CZk8g#943fw|cECa-5Zv-ta(_ou^u z3c18e#`FY5v1O!BN@)zjVy;eX+4?v`6VR;J2ZGb=u!Hx1-AYC#&>8(MQDIUOkV0)w zkOA~`Sa2$DqwcCyrvU3wNdw=eC#zZ<{?`uNn+A7K3Iz ztxhJIow>u#Cut1buS+cN&y|C&1!=|O$d2z%W>qmiaH$cfORL0Qp*@Dsy@4-}om-B+ zr}RQ6{+G3DhUNRv$2!pKrD=ZPCC(|u`>KxM>-^^)DCfme58F)-dEp>%#o#Ri4CbSF zK97@l>q~wECv0|U1x=(;0MD8A)ypxdG&Z!}{qLthM&5(J7Z3%OfG?JAIryXa63)A0 zQj={~pQvB4&v|mz3G% z8t&GVDY0YnYX8e3MKttbNLzuS;*X zjtb%HtDE*;um?M52?6_2zI^Nx2F}C6uFM*P!|%(B0HxqCIqbPwg8)Utk2s&IC{e7$ zL8aR@b8%<`fUdA~?Bj2-&YfN={$6eTsoM?*KzrWk9TdM;)=l85N`x_6h~Dw!l?Iz zZ%VlNFK2VwMY@co)toafh18}!K zMkcWNH9)I=xcz!;`qDOMSu|*Xq6`P2tIneCSq5;GRH_! z`b)PK!UHS8D6TM3Cy;M+7JBaE!}uDqkxmV!!NbcE0nZ1zs-<^mnl5zLYU_Cmk9xJ#y^T z*GWvh)VjoJn~x>Ya^THonFy?z=wo@!B2*BwTgZxT<^+G=DZAlTKv6RK|=j$!NskDjgvlUtu((zKHw1q zeAky2HT^sCtwiE>3K+NZ4XHMIGJY2C}ae#05xVvD^ z?Y0O#UrcTbySaS+nH3q?*_Y#}WO9_F%ors>7~SWcBub~Z2l|qq&5WT8iKi*$5&+qs zLhr+5K~K?VwshP(Mv;yX4FU1{?>8S&W-s5)$CCF2U?x3ohW_cfF~2b~nxWqkdd1$Z zrabKo)o=-fRk_{xoqXS-wt8CP1k?LNrDNu(hvKFBr__OO5I+*H3kOQO7n!uho!xKV z>V?0Jx*q-rd?t?T%XEv#UZ3!Is5a~o&hk$fL%#Gjz6;++jy;OgKuZ>@A>0fwe=m&# zISKuwt?JQjS`6Igzj(pccc8Vbi$Ql7WE@4!zSJi1vI%FRU$=4l(PWuTIdA5s8hMgB ze9A!;cM@N$-!%^|nI z1JIl*8MSxj!Vs60nL{t)q7XMK7h_&cvzrm{$-~Zap#7k9nKSw!7!Au~{c;EC81QXC{Xs56=LX zLOBp#NJKgJh`Prn`(dHdQCJ)NL48O>92>>oS%z9?iBsDv?~AlIbz_RXrtmgJR;&2xlFR*Jy5zmEag0C zkpR>PjEtB`%9s7C;fK!&lDK>9dT}Q^J(b?w2qE>fpWi_ub#L~kz|Riq_#3h%&!mpg zgI~9~yQrwl6_9v?;q|3kn+TrPBZcGI_m;omx(2Co)Er_dif?Dmjj;ng;q-|$?MKIA z7avIGMYdj5@|b9ZQDlseIZ@5VVh#?-pKk4~i;z<43|Q^9Dr%ueW~l`It|Zw?m=;ab z>uGLLNqwX)wsZ94vr^T#~q+7fs zg}x{}Y5PC1wwP*d{96rtEpGn35vGpU5l%Bx>hNO52=I_R7kz0dDVaNyq;~(#S~-Tl z5K!Ujv%Mp&pAWXX+{9T*v#{XMbwqc!fiGlSbX5ykle|3zW+aHagez{@xCt2X<_89meX~`=A#HLK1l8(=R#SPC; zdrg}awH@x%*v}x+{`rJO?_4rURCRm0QY4lhyco52Bq_Q#!5JtigWA&ZeIN0DtrKBp zwH`ryz@Bd)<%%7QZL)b}6+r(R?T~EyrC)XVNmbpN36I}lA zQ1Hs=-X>G&v^zyAvXy!0Z}skWG3tT?=>E_fil5%HZFzeKbz)9ikR9PE&P>i+_sJ?5 zNV+)sAfa6E?V@m(o}Xl*t^XAF@Ka0#omYcmCK-rgDwn~blQl}T0gkfH9q>WH8I_Gk z!go;57yNT64e%G`v3jH1#F>RB7z)VN+lIV9Jt>L3lei(3wdaOXrm0%Y}d!Kg>@#zz15;+PwX7h1J>O z`;8VmlQIg4hMJqFmX_BGg$dHOPa78N>L4q7^WW9==7%a}=*^TOHc^PsdIP3d-e<4p z%ibWDFr+Yf&B=tHI;jMi1S_RXt1V1k-Pib9_)6+Wq>SaCR9}urgn(7FGtXm7No_6w z)7p;Oh&)moffdd|Fa}LDOtV-A>h!oqPg^HA3%Ex1XV@;@5;RnO>(cH!@=1cZ=C{6kkQ0 zm{}bm@IVR)0n45Ci1%*C$Al;uM8o_fjK8qoJmQ{hlS|;Mf2if3wPUuZ#?a@tjNzOUb~B7V3&yJ@1p!Q%si zhxzraSH6l6LCou6vq%1!y2m1ajuU$BTb<}kb%ZWqCcm!tlbLcV=#7Q?baTrh?llcM z+*6n9&Afedzt;yAi=Z>QIW4%8fhqRN+5`RgI>OOPtgfYnFlBJv<7WvL5@hFkciV!7`ZH zn6h(LAVeJb{){<@`+)vw$uGc@1#i#i@aJ!u|Wd$tM;2YPs=8P!uXv6pR5vk0?H|_aH7-k1#e}KfcMxE@XgF)l!b*&;fioHZSu;{QUX|0qP>7MStb-5=7R-p zU?ip=)AQddvg7HK74Sb$%aK^!XMfv|nR;zl?!MU)=}!4T1*e5aEK4i{NL671@x`ze zPdUt=e%1%ygP^?CcT7Nj<;F>bmuWKOL1b_(2-AIH5Xt-Q1vX76w_ zsJFT7kr1AVp_M+pXmu;djaz>!>t1QTnP)0VqE|F%HQ6{(*bc3TJX(Cc0sci(u95e^ zxmh=f!CHMrqbI=!+iwJn?<_kmOlEAJ>fDb2d_+UfAn#AZvW*^7_J8tx-yjZ+Y04WJ zqh3{>UAOmFp=dq&86)HpPV#RDkazl&6*3evZKxwe!03_@Xbb;*bO+yMdD}-Li^<}1 zZhD%Iz-H@xf6|Jm!qRN}SS!mTU?=5q?Xm#{LWzJdmV(WF_| ze?gxWHZ!GXsJU;b6OZR>x%?_#ygyexcKcLN1 z!?lfhD_4cgXjmTAC@ANp1`d;);EA#Yt7WkYACS%RGV#$XBQkLFv8cN>Y#dP&+dArh zt!_DXPf$zDB-nSb`*E^PMQURkKkeIIvgEzVu{QTKV}s0{wP5Ga+M~xKkTf?pA7_eV z1~_Kyq9opazTk;n{-uKJsp#^dp^D|ykB!i%ATkcwOjZA&yB6Ja)R0-gL&?7!qGZxQ zNJuO^7tp@7M+{~JLChPmATycBlyMZ3y`NJ9@CoAQ&t(F$Gi6%{4Pg7F80;<{X*?7A zLtu}MmyhDTx!~}*HMD+Z*g?(X)@uD}qN(xO;XUvTbXOr=1@aBw0`G3Eb=OXHwrGcT zY`{`G4Esnav54lk!y+;y<&C7_p5NRX{0<3zS87wZQMYMzJy6Kigdcu1J*ld8r-{Xz zya+!inRVW2!(zPi^7$qutIKR{?T&u?8#hT9$mbAn^CEH0AnD2t-*XDt9mIHTQ2160 zn95&zSL0}hZoWgz?|>a1H$5y;J^GT>VR}W}Y_Fg)^0ZcEhd`Udp!v`=q%#zU_-?&~ zP#@~|*_A%^BtNa5!8mW{S|qqR>5nMn++KE#jenh^1l1iH;vwQx>g)+6r=lA$gY@s; zSpVcKRF;M~dL~md2T5q#Ijb^K)%I?xZJ-a}mkbQk>*Soo5u6|)7KAqdgmaW0M2M22 zqN4xy>ejgRVUdMjH2+F1w(d<#Pogfd6`4O|;EAP~+MYYBZ2rPcGFWqJe`z`Nj6)?v zgo6P=p%7ds^h!Ma9WNi7A-K@g6ym5UCFd>~3vP?iMnR5|pUbzm1*?9vVQL_ZY1%kx zn?B%tbT=0ee3O4zhA2g+e#iI<)};IRrxHhMBfIoq3|-gMC0Hdjo5ZG4Vp9U@&qS=4 z+~R9!X)a~!V)KC{hA9U`K%+3i0@>5^RTvnl&fK|fm`4pZ)2ki^>WH5wOevQ?K1ivgFl(HTlWJtr-#OtKb-2vw{b!8jS z*K~?cFB84zGmg)&oSpO5)y`|PdN(K~oj8>69dAYbZSLr&d&fEd0I?2V?2rt9N&voJ zW;M7*tX%j~I=Sa~54~*kHb#^ymveZ;e zRKVj%rB48PAy;8<%|CFN-G3@_iB1x{=CBtT{zm;y)h2y{)b29tN$zB-TC-xU_4M(^ zLM-c_f_yP$0G=d7`s>eXTmFqV>fqTUW$ksJIXOC-8`^$~hLuv=$w#Ctq(+=F>N=SH zrK&8IV&Y#RaM=G~0e%MgFOLUW0^qDUhU4Og`u;>urogkRXsES0q+75D&-hcyu@e z8ScR=Ud_Ppl;C3_8nl68`JfPtZ z=StpzRVYK(HhBE@;o-DejFGGy175ByV}_uMG!e20$1HxD3_}V){L%wR&Z*5fzvxZ5 zzLW^~X)1^PPTf0Jfu~MJyDuUpv8Mtls(+JyoaJP>Fx-Hu=*EA+JB z&mnar-IWTjXXnd#a_+$4^4YV9SC3are-h*M()5TP2&-mDXZ8&tcexU6TzlSr~8=@@0CNK6@24uuyO3Le2}165ql-5JIXiW$nllwoL^vprA81Cuxn)~onZiR1ku87tF0{x z_||2?#i~0owotbDYV9WGvwt8p2UgP(_XWL_0DIn??z@)aQH!My(gsPrU$m4vA#wqK zl`+iIEiU|{^jY2)vgOI!6Ygh#hJlYx_yZ{e#p#S0jYYtX+vg}2h(Wd=RyyuNp zJLJeTv=UO;-^T{{-Gq(?eg1zE)c<9>z>zO-@n-Mvr+#JH7mB#B zP$n-g|DQB9n?^Q%?_lyP4;uS_ZBYIXQlVU%LU~#|-zBy-*LS{X2}QV`cGTHxDZj{u zy4*oA3|H4}zQR2{3;~Uv%N>U9!%G})SSZf4b{R*O(>e^F4!g-;mJ7h$%>*w8um2Q< z$`I7DN1?rSuNsBBL;GfVCmRV8!ZK1b@Q^t_Vzvn&kB`guS=l;q7P^hq$?ttF_!x`D z3*z^iTGWydcU0DY2lK5!w-mhWl)LXvTDo=$WhvM*W~RL$V$RQ}0Y*#rC)MP!qcIAT zIt|nk(*L&kF+=a_L>PsL-9(W7E8tW zSZP%9%7Dvr#kl#`j!WGP?2|3+JFWNUUwwpK&ofPQ*k$iJhbweEDO#^*p6?S@c5@2D zn_IJ)-S_v{P_IrSct4md1#YwRv0t9npUBJN^wKM>dHy{^R;4V?rML=jHkS%h%u34Yf=~eCO4(n6kbT ze;cKrT>a$td;jU(xwdCYBkkX9)?pjUzaJuw+mPR5RXUqZDtjf(OT+ujTO>Z+(8u>F z$^E@pGr&m^U>30wQ|pgwxO43v_?A>@$nfllRW}p7?{ek_j~ZtL1ICmZ)vPS&x|;KA z*(=YJ4W*(fFSGp%uK(t5f`^qHQ%b7_k2{Gsaf}f@%@tq{{rQF3Bvxww59pDdx4Bs_ zD^~uQyvyEEZK3qt@jQb~$4f5|6+;JAtOgRth9Dg^(33wh<9n?Q+=p$KKYj8)pI8v_`dN8dg;oX5>j#6n4ap*o&<4skjsUL3h)6$o$mUpOtp_b zf5B|IfOyiBi_cIZ1U0Iwmb8~`y znwMS#oDUiOW*Qm@A8sFh+eyrA#978JRUh-yzzrc+rsq?sA+nYE#U1dST)1yBgg4guM&&uublwCr{MUz$uiO`GFHrEU%lP=c$2yU1Ze=$IWn%ZY za?R*Fq^x3t`aEuz?&k{4K6U}DebjZ#4`p4!nWtMJY*4`BWv50$zjk(3k-_$n* zHAZ<<1z2{0t}j{|ab1?Asx*f+UBI-nbp_Tuqn?&3qk4O)DpS3xf10}QCirRdy-tg& zXopqr6w~5OPiOY8u<8c`36?a z!jTJx&9w@qqMaV=a=LoxP8+Iga`TCWZj1Jr60)3@boIBVng!8{W7FTVqaJY%X=~Ph zMG{(hADHHESbI9V)y6rz94J8FNRl&$n#I;Iw3<$;1x=X`wtxbv82xdFY&*er-9Ec6 zSM7TEkrA&>oJ8a0e8SH0rkldo`_7Cl?_MIh?mZHodP+{fQ|G;Nufv~}HJ9pPbsbho zFz=IJZ4$fp+aD#+9gmj^Ghgurugrye2VaZa`$g0#g(L@Oz4kd;}}xf)lhJXstPa(Ewd;tk%y@>t}|gGe(@SJ96ZV-$A7VL*naBqX?U<{ z+AQjaMeZ-Qz+lMZNMdpT%+Rk5(YJK`J*``LSVL6%LX_UI|$3S)o;xwqCdYJT8O#e`-o zKw+PYDIs5CL5f4i+J5F*Fkupc-(aI2(Op_v+fT*FOx%&o@9D0qshS%ZVqckl0yu|{ zpJDm##;@sx=mvhWWJ&8clvap4T4Wt<)C6ugTIBU0X>zzAwu-`Qkc$T(JUqx|FuOCv^9el?(LK3(>^qjM zj3-XAKz_DR)E+efp3YCO)VER1n3G#I9OUe5)4RZU8T+z1;r&Edto$0~croPN08`Q1 zg+;}VHjKLLkkw`}WCe~?p!xjK8l+UebC1Wx+Tz@Ft>2T`Rc1POZ+Mlg$IqDCwATG<&9e(# zb89s}{&AY=HQsN5EjwNtCvrbZ%hDhlhUYi69aWZXJFJAky}PgW~u zsK)OEIZAV{N&q(27^rkV6EG=k6a*MK)ncz3u>P$pUg$~YrEc<h&WXlBI}um!ulg~hbhBec=9T(F9j49pRX%| zt#Y1QW;h_Hdwq_uizgIieu5OrH znaK5KX42r|H?$l@?Y79)8gF;J4sJ3%by;~s8F?V7Jv~X#_nqP>Iv@6Q+H98he6Kun ztJ{#O@PcGvGH5qujbrxm23u~ zkV%_qUDftT<&H>anNDB-q<{CDh}Vm{0a2;umldMg4uxS>mL*e)T<6t14SP(-sF0a} z;dxId#)Mre*)r9Y5652s($esjqLG-jBElMp4DNMBS}T~ zI4`=fp3E`B!U8zV9KwF8)FmY+<|#yF>io!4cZA&LI!{lpL1Q6l2+f78EWp~EKmVX{ z0f|Ad(wX7#B;F^u#ELg;SHPVv$nSQgc!Nus+(*$(ZgGgZzxL0S(_!(gMY1 ztPX=Y&VP}+>wmBSUYGCRWs;7UsqP+KkR!B=lC!AmTS%eWW}d2o{-q(_?9}J4(h3qh ziZECjNp>JE&cookFxK5HkBMK=)?uY4*xb_tsa71Dn1@?l->q|y($jrsro>cN!?@L8 zqgd*SC8Kz>^;@%fVAXZiYJLG>bqy%1(eit8Xc+DIVV>p%jcn7cIunu3=^=zF#*j$< zI!A!7l5KQAK;GIsFy3_UmQsOKfe{kJ%c!bNS+!Vd1GAUA_ zOHBKf_#ay_fl4*6$6X0hawvfFa?z+7=85K@0b0Bocbw9~TtMl4y&fWWm1?PIQet5= z(#yqG0&EY;V=Fs3EeSP@a;OxA9NAz^KXNzN%CM6P@H+vO&qoYBUOue&d`DW!yKo;! zt!1Y2WXo=8_;dRrB{(^94+D|xsc$K>sTp$Gnwp1&m~$1y7t}=-rgoVxCVA;QKCr%$hA(cZ)EWW8tO*W z#^ee|wP+h?WjpJ?+DuSsh0#y2e<$@rr)Z;cgqdQ}-(#pz($M$%(d&jP@V{Yvvvzm+ z%H0+d%4J$zX*DA5B1j_wYY2(g(%tk{!%Pb^srSB?c0R0b^$XA#yvl~uT{Lrt9iybz z>U^o)%*;aCk^dmp6dX%u;Xq;+)yQm;%we=1j7P*Z@XVSC+Gx-7f5N4iQ+OoGN*N$) z3a8m<0f%;$ z#A|GU>sC@}y-x6?qIRG`Fpyi`$|G+mYBGR1cL=>C$=_IOsYSjx>I3@V5tU}}P-)7r z(k2zp%Dyz~@Gft2W5um!U4eWWd)j^DLq63QuK{z4dS999t!IaCYaL{BrZAQ%357^* zx9!pnS(er$YYqL5IHI$>K8f(F9QywFZq`sX&W2UwnW;lvM!I>lAY|Y~g^(0MN8fGj z?F#qiGrcsFI=`d7vhwZ~T|bt9B3>Ph&A^g@yG8xGl!fa*YJiCmyB{7;W+4U(C6I|| zT+?>9rD6sCv?V(gCclvY>p8Sm9v@QShWHu@RiW#`oc(^_vW9GnCR!o}s=>evCs)>} z^_3KgcBb!yG*>32s^qba^%*C&-OoxbIfC!ftk;hq{n32z%a|FBX4XX0WDtIuUy}Y8 zEsR(SD|2;fJ#Zv5fsSeuagBKl?+kV6#&_77x6%{M*=cGr)5*)rRgk+aU@d64kkb&- zjVKxSW;VD-mF((td-ZNw86f!cB&2%tU=q0T#fh3 zDVD~F=FT}mUugi|jqAXrI@u``xudmq0qdUovMgjcPLEA6Zk%*9L~6>i@Q(^)dsj)* zxA|Y8c6AuGq1#E|9oFK0zuAA^W?l!^wc*PD}$)`*7`8h`#hqx&>ghu(P?LDot+ zoi+HybA5Ksa+|&e#k}+?*Rv{u>Cb0Rwz%M&Ez zo|`ElaAFG5NegB;IeJ70M=3&s!?o$N{=NMb)PGJ z_BajZkq|L8*YOcoweoE`37}OlQo238V$d0Al%OoyG9HjxteBLbudH+%C|4!xp*P~U zFu_WhU@{aaBW#QCt-N=5ey$SZ@~Vv@7l}3qupbWUXS2;)06>Yz6gyX7YL`6>Cq8`U zgTlb;eG>j-tG%<~ezAF1Z%~ikTo0bMexR{(?gO{t>p|zNPxWfE60TSaBgEsZ(KneO zdD48k%kf$-Rd~Z~ax&LXFQJ_~;b=)-Svey-B_Q&n-e)|YxXSdQzm2axOKEEM#1;=@fn#y3Ta`Wu9`Wj7oWPVHPUK(3jW#tFc+^S!LRUf37>sY;P zh}=8H=Ul2f?IopZY1g$~ENJ7z6T55E-S$tS%UDI?umwea^oT^HOhLTS<`c{bEDTUL zeC&=^M|K57efD7)HFe#0gSE&I889zVYaDRD2glr8k}ZuGu`?*u76So8u{eK7%bn&Y z6-SLyCT}x+nX68OMRC|apeYIn8Cc^C#oN!?)!0y{S60p;&zx1_*gG(#k)$w#{q@7} z#1w9s<3oAqBZ72LHA$0X&s){3WJ%dm!nim)e9ZqO&d3Gs*|5^fV|HENH(4aB<{WgF z&pBm%2*a#$a9r5`Mqg(;O_@7Q$I@A<4BW2_jok~{mt~g$6eFaB+T0Ws88D` z$mRC&g}*7h&TtY04J@md%ofu0WsQP{unJ74#i?_!<%TY3+>*h3q2Ur=HhpkNRP|7kMv4?n$`?d-oW=Sdzyj@z{;tWjbb~RWOI0PpMea)q znuKcd{ycChj=D}t&+q~J3+)zbPW{&X;!!R9xC=GMpV;@gPaW5LAHw$&xPMEHsX5L* zp_F0Knc^6dGO$zf3B7p6DIU4T!CACC-gm;ATo3zbQupP@ww^c;5qJgqKE!tkvzZb; zT`D}|;q|ZjJRfbvKF>DWhNC%0b2xMeS-m~=LAH5$OY__C)cFYqJn!{pBR<9eL&w&Xj!Ay5wy8oS-r>-)aufMM99yTq3+#DI z>AgbZ9|d`9kpqhi3TOV%9Zg4!I&$^X<>gXlu8gpLw^8 zLt_J0n0>KQB$f(0_vySp0I#t7(mVYFo?fx5`W3LzA0hCe3lo-z%?x1$Q|>ostBr*n znP0afV@8cu49JD8R)aoI-X9(i5~Xs6#Sj#X8c#Q#w6^6KDKT73T}Z>ME4(A#Cv|i^ zq)!FdGsfg)Q_P$Q=~vt^t=JtN;Qek3n-SQC$0(+EGNnc$;8`Y@Gz3@!iu|s2leX>i z(Kv`rK^f0##+y7B*{h+t&P+%&75J42Ry42HK zu@aBWJSAoPIFNEqbVy8A`&sTRU##QDQw1Q#&geu%sz%r4snu9>tMf(n^5tNT^JHzU z$SuwQI6c_KJ6G1YWgpe*{CB_eR!L`F8?>@^amHW0fDG%uOjpzdyja zI7gA^<|2s4e3}gTK}5 zt{BF7c#;XYYnW+dNhPRZpBO0=nBY7VV!h+?K=v$lO6c>Yrk9BfE>OXHaiE0{lg?u` zq=sbCV$8>XLMjv+fwX)!i0)vf*+#`zRzEmkPZ^gVEso_6*XI-lC7C#!-=3RAzC2?; zSrzAMr3oFPK5QQ_^&yzm0R$lLd8?$1q2OQyj=?ibsO_zsU^ScS)SzbV9s%=Nt=q zeW-M*X-rCFvaW?)0uh@!Ubjv=7aMb-S#`&+eD`|Ir{0Y{0eSVu4|g?$0o7bFba2`1 z?6*DvqdXSW&aZ_ialBYL5X^m}e1{j9ZUQZ*C~-*I@Uyy%tY&5D$k%F3eTucK&B?WQJ!s0)gK+p0VkQ|5<1{+#mu` zTVnqaSgqONWgX>g9#smrY{;-)lCx7%Z01u^l6K>g;rzz7xJAuEyjZF_mHlBv_3BpE z>+EUGb#0PX^_NXn1cl$>P99k<*TkMT8PL4};a3n@F1~_HJV$`n#Oatr$4NI{f-xLe z^yAB%fRs1c-df(c1&CF1+{S0Gf{f;l9{p%Bj)clQgOaCNoRk&$M(f09&n5^Yf+aqH zQ=`W=5s+}XFL0%-Q+wROWaRxt{qs5kx9I7RO*iIXluy&!Mp^erbENOX_==B5!9@76 zzEw=|5Yw*x!o6ynFskgU2}G5Xem~}w;)tBhtD?X_qn&)Vy2St3#~L^L)2gPt8WiK| z70a_XT3EKy+~$*MVc|2DiLBvzdLyTL%-IICB09C(rW>x`_PyL6uCn1#B`J`h3EG?31cm zHU;pkS2YnAYf_`tcJorX&m7sGmUmCZG$5A_AucO}vDOU?1AP*Gp|Fg>ww3my;~oAI z)o-mMnT6XqtGME|vS0_(VkYg8TU3D}ETq<266sR!o-#&TNaq@wySaG{g{v7oUmUD9 zRhtDR9|NMM9@v{#j8z)JgaU7gD4WV!ajbG_muL&6zUp>&icPZWlJdI#B|~fI3+iF9 zR-y48mVpw{NB9;aE@`V7e9vL|7t%zKg-c_WIz5Zefg@&&Cb;YbA zl{MdrYN8S*x5pc*8~nff0_avm0i^xLw%|Yg@3cBmIkV!-KPjaXdj7r-WeD(jJZvd? zg&nS5zM0dS&-B4I;JGs-JA3Vt;W~SDyU_pOkNUq1`0Tz5X@{0*t&MD7fo>K3xprk4|22cVzQ{&&JKw7Sk~Cs~LHi^IPgxRR=HRq)=yUu+WmnM0m)J__xRNUO@7ng*d1PSTt4hB5&-9zshKsDTs;O@^d5Nb;Q}-0#^Ryki;q9f@ z0&6F|&*~*+WvPmf{o%pHKMl3cha;ZChKPX0{Bjh;7lU2zyfk3Z6vIC#->_~OXmsR? z(nz?v2TAMo)p0+kjfr;ouGECHz@DMh4OrVFHyeNo-nt&`o48E1Q~g zABMx>rqgP)bJ1mkf74hH$Nrror8b}0Tb%!zZ8l(Wm;&y0^|}cLU}B z0Em_Wblko2f<_UIU$MP`z#-C!#1X_A*nSKO)>!m7U3+&ZQ$zSO%zQn)y*J)OnJ{el zR>q|<0qF4|wqj`RvY`o56`HLbY!mnER zX@ksvyFLy#Xk}}=e&PAIXxOw7NXW~(vA_&O3;Q&RbKz1!Ll0eWLGUI7wYbaC)OJKL zvHzs>@zs@20VB4_{ss`$^u zKK)=tE3*H~=t3smX%k9@kEp0<2^-1Bpo`|Nj=6;evqoJ#U0q#0J*1D&f8i;p@F6rb zG(aGb5SfaTb9YbZEpMSB17_5h`>N2fXOkN9_;_t|h}6s0UE32q2JJwC9%AOSu!wuJ zngI9YD%ha#OvuT-1-#Xi*&6XCg=4bO(+}ZbLXa6WG-ae{*=Pt*>DV2HYs<^x&wPHZ z{%@~3fcIasb>J<;Ul3~n&iDeDf4LyeZK1ZY&mw8vlK`3$vXhXxciPpj-RU{v@PxueAM%>6k`ct+Ggv)`QH*s{c2??(H zQ)ORza|{Q89y($@G5%{*L8Vht8~5=yGxni43e61f_1a}y^9 zJ^{h)=}HVE3cEPecRA*IB#`Uqqu=@HKo0p|*fK`5X!Y0Ibv$vXUdmA@=c?V48_T@O?(AqAzK^+jMnI(g^Q=@SBcWT_C= zU!(9`t&l+dnN`Dhporf#VE+P2G)rdx~sIa&q5S=GIo;Qe33J z&mL!(i@91sKy9h1srHd(v-v^aG7`Q<&-C~d(P(nUN7D}^GvxTFM<$>^VH zqpGS3#}*_1-yV=v%1d$Nq~pq0P*k+Du@U<_nT2z*P*B+YMF+0L~Gsi!Fd*CNXP#@&=evl6tk(wFYe#FfK*@ne}JiA`i`2b+1LzbIdnEU ztodUu|5CU1Y*DV5%^}#nl3){!ydQ<}mF1t+aJYHV-4TKMenlS`x=(7rvJw3&2^a-m zhFDV4I$+j_9$-RmZYuIlj{2C-755#~c)jbvCfDjc6}+*yoPlz@mh$;P5Q<=(&z&J= zpZ`^sk(p`HiqBcE<`L?J1vi!erVL%2miQ%%n8l(~8y)XoLen@j5{ROOwUq-#^v`7$ zn1>-XHxfQeGiu4UW#yC^x6#e*eMle;CZtMU#GdO^`|xPb72cbDKqbM4(F0eNU+VqY zqf}>IHhzEfS)ke6w6@$aR64bm*2NK^D53r-x@Vzh2h2&xS6$&CY%;;-f(sk*#@gF6 z=@G~HbWste2*IMf989S0fBOD8IsT`xR`|NnY)#kd)j?@q+sdgIU4ZKvNp4D|uFaeq zqSa!29Dh~8L^N;CniMy|5~>qIKvRyV@4v7rP=DUx7sxr9x!O2C@M|bJ40&~YG(_Ni4?us?L) z#SLyLFwY1&9v(TM%v5L$d?94{!0Kgef4X_O{Yh>si^+fWSU9kUfMh9t)Fp4>>T)2* z+W&y;u2RmFw7Id&c!G<{TYYh(Y-$*%l0Ne5mv)<@r5Zx!&*BOOK4$_~JyxHzG<@$b zIXPnEj~{)A_0X&Fi8tthH*sqK@mK>-jUedIZ`_KuNXDU|jGb051#U;$go;{9c~$$Z z*DqO?5KL3ZW0*3X;0~~+5TDdy2jPh1{&$G2|9&0Tg#F_Y{F_osMbpc5Q|TSjXQ*n% zNmPSCy3g65efBl-7~&8~ve%<4#j8N5dRdRzXlPwCTGNFKmEy8FwhO81Iqja#tH?e& zm(P$#7%WXz@z=?iIj(t4wAYv3d1uDWSY2TcCzM})TKF7GrHp9~uhR#u>q*Krub2D$ zyu7@89PsvJu<0ZzsjHwMpn~1@TJ19euH0qD`{tfR9le^-wa*R@Tztx16eXsZ1C;W) zNP^;OMqUecf?+^gIBV=m!RFCBeRLJO?SW9AoFSDR!a^NiX5_*uRJ_L&U{Ah>xSWNj z^Pe{_kOInF23B5oVU@5ha3e)SEM1}&L-w7bh`o*zuwX8niGw`D*ug~JXDM9)tD@}L zG|gR|2W6t6^fM>p+s+FHw5dank>&=(TnR#($jU)7~c1@Fu;pA4Cphf$(*43ReShGT-Va6u(+PvZ9F=dcz!9f zc>@wvu=JDPG13-Q4ZM0FMDEt$@G>EUf}4qwt-8ZNNE~q=U!E1~ip4lkQPC*g2)ALf zBw=s-XP5)-j~)p@MR9Rsml1}iJUJVF(oLbyDV<(pq-_6jM-Bm(pRosTfcsr&Y^6=p zZ;2+RE=wEhIfFiptui`IoOX{*J+0fzS&1zVIIg3)y}SU++8&{7>T8eO<)_u7H~eYR z*^WDZi`&DUg=GjWW@366G>!dwTg zy|>5$gxXp@wvggYkQ9zucZ5irZ$#yK?=)s@0lz5LC;dq(O{IRKO6%0H@@T2{g(^<8xSX%8*D-4Bn+M>6F=Y{tmbbEgAEr*xM{MZ2dd{^x^QJ)kp}@`T zf+2NwB*I_O&xMMMBbViwKZn35ox!;*IY&{lMPIRjAnNpf4Kwt$Nr;%3r_#i9#mNYJ zp`5!^t3K~HOpuBAdB=~?{hmPf><3Y5>D=hxgfE6`nW7SYZa2Y&EFq#yv3z5@R%7Z; zOC=`FNJ8%J{?B(P)-8jGYVAz+TEExF~Ypt=xsp-NWzVTFHRgaeSf4;{9GWXe;1) zvB+ih(=6M0N4Mp+1+m8y3MG=8!>g4A+XHpO`RfxGq6bwlW$NByn}?>qT3)D;qyOH( zPp2eVwv@9xZZD`Wz~^Ok--!gLt=MbI$zb?zlO$LJYBXTx1CX{fxnwcc1Ye_LS-&~o z^okt61l*31n(DDD@3s?M7II#l9{o$HVyOI+Aim=4MjW3+7d2h`R;SNs)b@~0^NHNc zq07c-@!H+-a1Fg;HND0coPH+X?XoOYyvv?C&(n?8dNvimhb7qDSJD1Ydylwg&H9cR z7>!@CxkW#$5m<&ZQsdUlU8^v!HQwcu2t@9#i2`<^Cl88)@Tl z)Yfk0??qzKx*qrLFhi&D3e@p*)?8`ta+Lw$?zN}NRk^-~xdrR7gvq>Z$VAq)E!mHX zSUOB5=PlFR`Z;si@9q`9@q2yn!Y#M6o7xPo(0=H?2?@NCM2FmJF!i<_K>z~@5Tt~Y z{1NwbW!)p}dgv)}-IWM+LbkwZ5etUgwCVPI-4yA9qvw${EkT2vRR9^(0WL%xXd?<}cYV}6Qkn7RvxGx7-VWzGt#OepiP4o}!HWw) zES>Szi2bP*QZA{FRvxt59lU(IlDE24^2sy8uZZ9 zt-lTuAw%9AiCr8ATORDCAe_xDyNk!WcL<=Y_Cs zW0L>B0W>^L^diYIj42?@1!)$T-?9l3-0|eRA|&t|)6mgImV@9O)5b01KlQTE&Tb53 zwYD`vLmy&D*|xGJB%r~-Jn*^ua*Ro6TMNCFKMdX_)XFv9ZS{H&w7X0=shxTr0*_RI zhp+i@Li2Oh@=U2ukn<$=z{qRg6jhF`*u=6JKhbS)S=p zzg(m#Etl|OF$+kWKDca7MI>^W zpTY*(f6xBECMtYEF<}vrKe(izW8*30!$gfq;&%8(`e0dL;~G7T0sEe+=IUZ*^rsz0 z0HN&N1L2S3peJ7<*Cy#=wApO=m(8spu9bzY3(4RR4mUTO>&NkqwRE4>@LQ=ukfKmV z0zJc$prF(A*$8f9R`aY*c1U6FW~6EF-R%9y789X+$+9!Pfq8n zd2*u2>&AugM>YBE^vL$b>e~&pUo+v`)m-+Q_#fE%LVDs-A(p7gY)?bJ3miQ5BDJ$YJ zo>AJ^vv+OecW@Kha$fYw|K;?ggze>r#dI12!xOM0%KvtH8w<=q;Hwc+9+knRR2{Ar z4;-!JzXp;Jdv4}!!^ov#ygi?6y{&>Psd8h}qHxW3BH{wB`qr3kHRDsq{mufaT#=b5 z_yn_A)F7v4->_`z?Us>d(5}vn>uBDazUI^{J$HLe+DKz%+f_7hd1irVb3lv^1*xGi zcyu7ns#RC;b&KtcNHxQ&EK18FU#up;OC^R7YP}q_$9&>hsZUEQkCA~vB5l}XB}m&^ z|t+q~z~J;J=Ph$nq|!^85UUQ+Vq-@j4Yb~^9#g}Pd|EbUMra@(TTR@U^h zcA?A#+wn1m)?YIJaxYs%qA>!#z{6b#cm-^ed8F6~vU>RYYWMdwAf#pA)|S2a^@wy7 zC;?;~?9bPnIr;eN3k#>M8zCnca{qNCP%&KVswN56mYTAnsJJC<$k5MOJh#WvU1xE`3E;G&GF*2NFK;pcz_TwaTuBR$pMd^YUd*zqww%k* z_R+HeqW$p*Sjn$WQ^fjGlP)VJ==$*v4J{V8zP5JZB=?pH8tOdg1LQ39soH)l{+`tK zPf)V5&YKoV*IT#3+Vd6+X$D%a(dx<_=tu4Fs%h~*Fr z=i4L}=`T$VvIwjkWlL3S1H3w$SMO%wIkriV;kFpiRgrt3;nCNEDJ9tSV>gTlNhLP_gmIB!wnm?NuX9OHoXi9ehEs*Dk{QkD1LZQg|ZPjL2}BTp(pfoJf6o`s7muhn}WQ@ekOp>jRNlUdx{A7 z1W_KMIZJX~Ppxr*tiGsBIoy$OIjnI>_kw=neEYI$-FD+wu@qsxp$hTe8$xE!%CCqP zU+no<<$W`|aPDT<%iyQXvfStH*VnNiNLWI}wY=5IXaebL6Z^(R9A;{!41M#z={t1X zVV=()xJd#Gq@E!jgma=rdk;G*2V-O)A{6sc;KjeW2K;~jKlx$-iM=`y`F4l;pRUW( zLIkLmVP!xW-T{#CuwPybgN_xRY{4-Y5ek>dG7(7wHBATg5AFj7xM^+{e`TL9%*iBj zimaAxOsZ9W&%cc=m^dRl<4=9#4A&j^xxe%>O0Qv6K2e-VhpVSD6^3ea7d@1d$*>dd)8MR}#&n6W? zle|L4n{BEmde7d;ZXc_UE9-=G*sA0~5Z-G5&&MjHvyOjRtBq)?$%!krWrnuF|Is;< zLm;Q>W7ysE4qTCObJGM>6rMo(a74nCD}EApXb|M`f{&L<|NFkGhv$w| zmrXG{clf0K^ZmoD#@zG$25KkVpup_VlHFUux?!bnp9&C?`o5*>t%1E-*Ie_r5khOLLl*CFCzuQ?RW%zI5_F5w$WUHg zT?XQ40)zN&m1fSn`JdS+-Ln+oy?7dsYwLm9CJr~;j_j6}dv*_(j#V7u98@um8L;)S zt&XH9HK%awFy?@{q;cl$q97O57Zy&cMS}&CFLgL6*u&23dA9ZI;tKNJ?B$T$-W`?a zzZ%lDGpZUL^kFGtaBxIaJTeVf7k=e`A#@@Km++i?LXv{|UO@~I+KcVl$E0EtGopo+ zD`=wdr1z|=Hc}}y>-dE;Dr5H7#jKRtz}gz(XPsU(ljG85o7h{I*%?bu8}G1S+xUF# zvC5y+L98i1NC%CiQksjyMW2Mi(cKt^RTszQVK9&=< z&FTSCl9ShYwSY=Vg*>7yR;I&EsG5=T6Jl4NghBI0uXMtJBDE)5=#?D%Z|1snqdp}D z7D1_S-z${Qb6q5HBtW7P2QVOuJd!$N+}a-Ek#oET!?fw0VzfpETIeg@F#R9U3d;w5 zXdo`s``(y1QwClxRtjChaWl~K^x;Hsv>|5*9`RtUMlN*H(KE3dw=QG5ia^UH2>go z^WM=!LQyQE-0T(*Bguze2itmGasb|i41)OeleuevfxVoC+(>%$J6aMcb;_7PLgKn| z2~*~RFIQgS+@UPY@T5xHgSdUu_X}!|9Y0{z?e!~hr#&FOZP8Iu-TJacP?nd9KYK6< zQ#=+?+FzET)+9WE{%+_VchJ#@uz}&M0hXhBTl4wOIDedPPs5P3es4Q z-_y>9K@#MgQ47{?KFr8Mfnxm=(Oz@;4vVEI{6!&jQ>yJNDX)4~>|jC%Wcl&r-4b}$ zF-JNisA^qI$@J)xQ@ctlVtbK&G?@b#W8@AWSGZBTnJkQgVq*hXuSLNeg}bp~iX6kV z6~%;4xHInvBtECWTN=LMHMu&;W3DZ_)J;>$$}6VgRrpjn67fK3Wqt1a+--7f=a4v1 zvV$3B+%j!XpzOi9K-juEKG||#kj-5)_^oykTA`qK(l3*ki>iWqFrd-gfXOR&A$|IQ ze~vhYkBLHU)14;=Ic)`+%l`vZG}eD;bK_3*B|EVCL$9n_L0f?66}OrBhK4{yUav-T zF_))?9=w>WWP@b(=dg|^*C?mM3j=67zif61T^dOzJv(eJuK^eX)RgX~Mh*fZ;=EQp zGQ}7b#6&H7$S!7&E(`vU&I!N#}C5iF7?_j_h3YV+#>-x|&vdj%5%kM{K5n?+ zGc{4u(MS%JkTuW#w6nFg#B)@<4(jRSYq7L4eLEdK{lfH6OP`%4V#n=k3nevl#9D?g zpb2*M54(R7-;kM(oZ41pOgePZQ&>z*9gxf+axzX!wTMzc;)|n>>7!Ks;8o1yyOZEB ztLRKB=_zTi>CK%caWjvUnc2Fi$yN&tr=inVLp?a)d6bA57l{pvn5qT{MpTtm&9B%M zKjjtY8Pw_dSO%Ddy|8+qVkb0y^&)&amiM8(^Q&+wID-zEw<-pen@Hi0sySeS+EdLl z%RBA4lmfOQnryuUyI!R=&gAWv=ed|av9cSws%Xk0<|$AKT4EQLw-uM$bZ;QF@2Nb2 zg2LRk+kViDbO{1Aoqo$G`K#-ItN;=$q{v7B+sE;NR@uf`0#BDz3pqPGz6g-x+h{+J zP$q%cnGoP6coEAp)!Q8yJ3br<&34TLPoG&+_FN#lCCnB$4-HNRWxB^^=7V`As~a+x z_uDo(A^Z94zPla@-*9Svoq=UnK)OOoqXbD)h zQpCYWq1h?aFb5A!9O((g;5?XZQ_m69POcfS)kz!kM{WawbcT*&%GF5xFe!#|^sX|;)?z|V>_yqL< z241Pw(hy#5sij8J#PKt>5Wgg23Tw2%ZTHo2I=R=@_qX|jW%kOJWiJ<)lFVVh97+_a zT*FiYT}1(H&{5vNQIlG)NlW@_coK;T4++n5ZvAvCk_If3r@j--(w~H(5Or~sv?#pH z)rBW-H+;TUkjIeCoa+<8eN@%An1)sbsxD=`6U-)U(zGb<^3{yBo22I1aGW%~65$*q zsaquOeg24S0`;8)D9iaEvB`E0Z5A3QU%%e*)>UErX`5tkBp&|!B634FTa<-Sl@Afc zJK3o<$~*oz`%Ui=ThicFkKh9DNbmr)~HTmO@ezRX%TEe2`{fONSpk_{ZBbq`-R}h z!C|>Xkt~rC2-Ant4X~o-_fkbvCE{HuqGU_0ugFgv&P_`qKd2-vx%MWMj7h?nF!|-C zh;KxBi_gLN4nYBBKyGMgEbU6i5W}f2pkZnM7AND<%A9UsgV~BW>C*BmmAqX~Rjy~3 zO8RDU-7z;$mhr5Ih9(!C$D?NbY7C$+(-WK?wuSzLbIrgV~5xU93~C( zOA_n(E+oh(YAVrK9Fi$Z$A`8{)mgIR2cJ9f9QpXjPF9sVa?}n;ozUuPXu{_Stwu%G zyOm#G+J%7qBn8R9BHJ)PL#c@1XP-F2zNUhPL6k-&ht?NkzzxIftOhTi`VJ#82$g0i z^p|(b7iW}T1RrN!OR2Z-QZ>ys`(pXr3of=;dx;pR%Cm;q0sul4V0z zVe@I6^TZQ*ncv8Gk;(`5r>#jcjrx-?ke1YF*=~MDa<4hAc6|sI!-rZ!< zdbtu6JjF_VoKeua+3Y9Cb;sH^T|jnl$w)5>Pwmn zjeAgeN%a@y%>w2=oK+q}O?`ivR;MD|iTE)l4Q(6RC77hfS;@}tCsXR+UlE+xNC&Mk zt-w2a$|36Eh-S_cn@P|6Exq#EDl-#k1`40RUGD;>IyvS)IDPkbQ|}sGwqG3W`?b}j zl*BaF$7D8!BAr>$L*(Nm^o+DtxYtb;ZfL<}7gt*TQz3>qffU&+_bk4V)hc{BOkZns z05zJB1AtopZuZF>Ida^1jEvd&!<T#qfBfJe{0L z=6IHnTBb^F&uJN-_O}AyG}|z%tr6I=?DCkE$C|&XW||;3FK_J5HNMaoV;m_;dgQ-~ z165{S@TpXX8=5Sul58uMCa0rV(Sc0geO1RwOEK^7*Zy z?6Kp(`JIdKMB1gmB4d#FXQ}Bw@x^<4SFp4wn)vgPb(PP6@gUgn&{)x}E9x65WcT@b zxQ7QGmPJ3=qhzM>V7(Jlg@!fi?3PP?Kxv1wT$fgEf>G+(^P_Yd@Xgz)adUHu}-SF|wklJpE1$ic&URwpN_+BeVgkoNuFN|vL zbHUVj0>;?a%p2__gWSaNNx~HmdAqyNOK##cKwX`Rr^-s^w*S=}A^-f2Y2Qxjs6z8` zb^WkfVz9WDTk+g+F&sB$m=5195@D{i83G@?udW6C~rge0Hr$wpERzp z3k1mzN4|&T3J48@z(F?%_k>FimcyotX0?H5KJrp?H3A>2H1Vl0j46|Zhdrzbh(M~G znXxp2G+TO{zRSUvxJ^~1ie|zfmz_Z6M!zAU^!{%PbaCqYLza1(nOT8!bnYHj+3Lt) zqV~ukl!$w`>Lk_9moCm~mnIEuOy^}JTY)wlJ!ST``x$8|BzEN&CEJeIDN+M7R>vjp zdDqAcXv^Ta*xAL< z#`s?rQqhv}GYM%~+s&{1bgDHO8EjTBbu-bGlXTtqFvj5*$iy0hU{DFy^?BK3Rc=em z-?Kmdvz?W{dt_rB@XrKrB3@Uob5%e%%_3!IuQgV^N$G)B>7IeVU$jP41bv(uBBt1E z;uWxz^vZ^2FnA^QtC$m)L1(4G&s2|W&@kZL+#gz=UBw&2iOmcD5`zs;*Wkdvq-*ae z<`OibHBbMg8mpnRz%A_CWT#=5pc)d;2*4Oa!XTHW7C?$2GM)Z68D8b;YJLKYvK4#z zlAVVSv|Lu#FY4UT_aPan-PTKuHyyQ6;hPx`wkOd8J@F$Eaf>42jiVc1ZkLAO=x%@b z+cc<;UP!|jYUB{fjK|3CQPOuYe!EA}8yxp5y|GwZ#AOmBEW_7r9aS{7FG~y`4i7G6 zA*})bRK1N?$WY)~AK!M`AL4DARM;7cvPb?P9A>??k(&SBq%*Dztrvvl_(v~^Lp2%w5wHOuS$ zA)qv_%8u(|(JKO6T`a{Lw(n{E#fXSA$CKw6BD3TPiV}JQLj;axL+0S>!zpuf3HVyh zI9Qbo#LJYPoB_DK!`ffTv;j&B!45(Ndc*T*)J2Q4Hz(*;qzM-vpM6H>r%Fh5y~NUJ z4QNlS&IH5=H9X4XRpIg^L0igvZQLdVq?)1!1*~W({8zi%oer}>-rQ=R+`hh3vX4$KJ~;P4nOEref#F5t>qR=P?V?>qxmMBg zHa7lQbGF>t29&Wfq+1hd!2YMypBAHPmb`Eingc1b_<>@i%uwUz+w43UNzIt)xnvX% zJ4W6S-ae@IgQ#SeT;Fe$^kX%K)e>t5swI|+x_({siTr$(4O{sNKJ#zxZXQ34=KiHb z#R!w3+->j}|2`a_h&!QzKZaPAy*1U4-p>9|WY?&*;&0r{#=^$w=jHuQWyXPohs%kb zRxHto^y`7mT@Gbr0OqPVL&`W?Nn`defV?vEvn-;7LaYpCg%X!cOZPtIsIxs|i#>Rmte`7vasQ2*2C>!-*aACANL{ zwkTo2^EwANNcL*p?uSwn*bEZE%)GIT8uO2MFT#Efjgl@WaGW^GXW1Slrnf)^^@7;N z8rk=z|4Xc~RfOwxCV_^mfxfJFi(L_m^OBQzDO!vGeg;y=u&HVXGT4zo_}2Dz9*ZWD zn|F21*d>lJO97JFFGi-6m*ckEV%dfZkdQ4x)f)uS67sNx-V5P}@cIwemQwyMP#a&f z9_`Eg+NHAJr<_Icd#&9*YgTLr)u&gX(~$A({8mMKDmyya6D`lu1TDjr@f4r6L|bJW z62NQ(x1n;QI)1`~sSW#4D!C(c9|Ldq^jmPc21Cq-)x%XaUFkgg@M0w8iUf(Jw*ceb zx&Kv51e4dh9BZw{24Fp=T+LVsA0mUBc+OipZ8q2r<->b;lfY(@kU(ZdQE%^7cKxC2 zF61WUx3`!@6GNt2?zRA8!)?kaYxNI|*bAun^+*XFTSMc>^2*#yd2H5%m-8}(+R2!} zGo*H^4&u_Rq3gmsu8@JBWHlSdIP5y}?rHrr_lQ0|QPaI79Ea+A*$Ou@c;LDiFCUX- zPq^M0xzvdE0sk02F2kPF;v$3(qJrj!;QehY;~!8?@%baW5=k|n1r)RkozKW& zmNOteGf1ERNEtacq$SmE95D9LoT~(DQ zxb2WPD~!@-X+d$3-Ri75V|=VA3D7jnm2(i)3CN<%8C7s#oyNH<$bryRZG3>m3Q02r z4*EjX48Xd|VhV<|67tAUnMhKaPwz!gJB6fyskSmDrZfn8YfAhCXdi^vmDa=7-roIe zEB@{1SHh2LJ}qsQzl{WPPIBzfAopq=g!cJbk09=}QhVJ84^L+!BEz7JJ#L*8bD69O zPM}I5AsDp3W0+pXCg{2e>+~F*s?r%6mz$}@)~e#Z(+&%C$^`8|at0~q-9#2zhmbyO z0&fHz^glgVZw=S%^}Jp8o-fjKFxk{`JDHgH_{Y?IE!!B%P*5aW9H=Yu?wDPS#?3Es zFluY+RPpQW94@o1-J!q{qOcRdcB4Scyvw_2E~+XPn7aZ7n_4}ot9cCxnfVfy{lda2 zJh+M3yVLv_+g8_ndi;~FKv-1L&5uJN<&>d5LEX|r>TTD@K&?v#a6lfbeaP(`N;iNj zoZ5`p--v&*I9u6DF@G{kmc|%q1<+o5$(Yu(hD{Ic70I(Zol}y;uJ@{Taa@leHmpN> zIPNHO;o2M_DA}X3*U$V}L9m=t>Ju2&KSHL*v5O7-Ayc&iZPUnN150UFwgC*uAk81s zR5+~hLQg;dWQ?SlGbTAMulkfzad&yLb@c1Xu#{&J`WMv;&VxV4EvKW_v+f+e=kpcwgfM)|{%$S#3BH-Xqu>p^{{I0OcG=3Vw$*gqSTSM34tRPEIzU16J9 zt_7+i4 zz=6??yZUR9rKpDW`Ps%AWO+tvNuS+aH;gyo__Ai+pQo*rH>)Y1{Ie_l*y ziec7-`KT22+maJCD;X>VrzKA+9WQ|k5^@$Ua-G$JOtE+ejxe>Etmu<~A^AFr^>ta$ z1)87P#<=#J-?8@D@XZAvWsD4q0rzdCy431QTC^N#X57~4$Na9%Z|#Z)XLNbJ2WvSN z4eAuCX5C!LIZG9cVfVF5&2RC%(xaE7G=65cg%4O36APz%ex>pHg_T3R$JwGcp>}#Q(IGew zr$5+!lziMGYL&EHClRt}P-jov)opjH;LFH*vrM(-@oQKTbMD6f17>5M{2V4ITY2O< ziRHAp+&_}G>mHw#!1>gM(7JS2rdx-?QLTu>Fn)G8cRF_GJ?%VQ9Gt!*@WXo`9K?|8 zt&<&KoWx+-G$X1CiK;BhN@u!Toq|B;-zmYMu#u+dQgpPmv=rzZ0yXOOTl%pinlE;m z*gM$k+B#|gzNnzaZ5wk-O-trZG}Y#$Iy%XltPiMDLK=|@aiFV%_E}Ijo>9lr+JWc& z3+TBt&~Hq%YH}IJRR{a5m_yPMH5&HJ%9&TrnZtPNUHhMsFcLs}!lNxMK>9IV`lrW* zr{=OCsQ6r6-FlzLr{M(E!S_g0aejM=>rk<^tzRb=I>h$+Hju;f*wTY+f|X;usnBBa z!PIl*7nw=FOB$mQKNlk{A2$yjuUf9~BRhdzgx=fvgwS&Z3I5ybU4LAiuN*@2Hzw(` zCj)@sz5{!mlyfUQ$CHb^9ey{BO;DVAdXEX$_?qsovtzG=3lwm%ev|gvW(oGRm%{Kc zC%E+9m$u`Zb}uIt$o#TwNu?}T+#moWLZ02gWoX*3hio!A#kMegn860~%-Sif2OJA8 z1stQQVt{`4O+wx@hRGsJTS51r)hCm{TIP;tZ3eWkJ4vD9zlp$rov22prS{xidnz`Y zB}rTUK1(W5%5oLw(|xY4Z(ED7c1~EEUzoKu@`HC^JAd0}8@bK)DO5`q&hK{DALfr& zJ^)vm9#Zp~E?|Fn*>5w@``#ywOm&0S_r~#0n#<)MCxz7A?0ERmPEUxv$ty2d#BNu{NA@mQgR+P_HQhUJ@aEjWhOQLFTdOM%h zLP=xuO52o>vIY7<<@Cj83I@Zwse4q_@KQ=S50xSMDfK$Qy0OKEClASLcVZq6O!Al& zIyt$kjoJ#pjRvzFi}MSW^PTV=i0NZYldBtz8<*=IBV60j(agY5ePy$s-L|8k*U7M3 zS@YdY#_d$S%dQlolDyE|b;%wMjvPtDMf4K$ZuD^M^Ydn_eX=jVE1T=~J`N<()|G91 zUZZf@4rhXT*|&y^fy*G$utUS|aDHJ;w*z(z_fwZs($!VM!?;P%+5HtAU19@iT9*gH z-r+U4?CL5iE~aFW*%6XP^1_)qQ^?18h;D@L68=Do!LKqkH%sqfv|Fovr;WpcF=ijS zBgjZ#Ts1O#Y|N-DqxkT}!W#$^JgP74&rZlHNXgQOi%UuuaBQzIwd_qbb$wuBbgjqm z(C^yxJ9GCaWV@q3bN%Sd84^;;heMeN52O~5QtHxmAP?z3#yprM=jgqGJvVcDskZgL z-|36n6OihX<2u{G@ROMfc;?YKt>C*F}GW)X|4@qX%;5FbnGkON|B(djj){j9~K z@vs5C!wWF)=lb=l<8Qt*CL!BuC`z1)Br`Aea2C=3itTXTDy&ND)f)_QL23%Y9>ST!5En-9sSM z_@|r|L2Li*TjNe)g&6v5{@Lk7!i95r1Or2PoJdX@ImMR1r-&#$A5u7WD z{pXD&K!H*p#SRm8YV2a$&C?Gu@CD8F(4}Fk`Uz$c4JtbsL^#L?3;L6M0+%O!y19*J zl_gP_;33zp)GkMXXYnH4%I%6p_C$XC28*2z zK@y5FiQ6LOye_Xrs7m2%xC^4d6qraP~FN&Jt8=c8WIqmXj(!`=7R-Qp(c znP%`C$#n0NyFzr^+pg&WGpp4|P*Aya@?sV)ZoHZC%3p#6Onde)&e$@kR>V#uUGg(? zNB}%HwiAJiOO23QDwiNPlBY`+@bGdK0_gyLcP_6dFeA0qWuxX)*~j#+g>BEvLr*T4 zP=uc%xi16!#s7$TGd?q&sr`m^1mpY_ZA5(LfrflCC*Y9tnBXhr^7s{Oth-G?q^8{n z9~mG@A1Elwz->gxN4L2AG@2!U$5pyUB5tfjl{%;MfjN1x3j5jV5pw&s^ZDbH@AddB zP3`r(P01e&{@D{NV}@ksv%{2x11TXY5isW+vRmCo!UoL>09fa$;Bp6=7A&ob@8rvK za2`%$^iQ9nY5F5HxpYv~j9p(3mKqS^^zUq{ZToMvePvWz-PUeepaLy@TdYOOix;PO z&=w~_gL|R4w!t+mlv3P7aSb7OfI#t59E!UaC%C(O;hgW>G48nc+Qxr28gnK#Bq>SA7zmG2)*Wrkj&NZWq%O;D>Yl_ZdoGcoxI9vNtnJm!8)Oxt z7o^^G*~7lNy35D`$O{XWvl$rmdP`gD@j9vGm`2=_?T3q_m|hN+?Bn{hM}+O}qr*dL z1H((9*L^kKU%l2_gK=6??Sng?K#3>=jlN!-K%fiABr%dXuT2&BJU=RQE)l%4f0pu`rWQFYw6C2% zx%Dx>d~s}*oXm*3a0z+_>1U`;y?NgGTZ(~!k&l5y(5SMr2RyJl(;B~Qc^JS)OrhtUNl@7WccL%D)F2tT|d3yljb67;jx=;Nkryw(Yk zI&g1mncnY`^00M8%+6?@zn#P>f(}ao8KW&Y1X4zH6=KPm`0McAv?>ilb16oAG7k?% zHPKPrkjIRqgWB#Us;l5$uZF|eL-qsyM9udIZ766S-O8CV)dO;FF1M3(k{h#cDAd<= zAYdo&f(=wA+0J?{rJ6{TRTlrUchz$AV;dg#-Q+V7mhLuN8VwXx47~dZ&)ULoJsWO( zGf@>02kSob`lYX7G;@g3X`F2k1iyAo$PIr5?<-h7jWPK_14>yJJ64JE<=4Fn$arSC zK3XxnJ0ciD4~!~Gs#5pF=*|od{ZFAjV-J0}1wnq>^Y4{qbdv1m&6z;(YV^=`G*NWx zU9FjC(=K}1TwslyZSa)ts9db;+B!(W+i86|{B-~8<1W?dAN+51gno#sp5Q+TP1p-v z0dR|DM~78D_auL)I6@A#F{2Z5J{$aP@%03!;vG$ZAq5 zh;LXoQ1oWGwK}eK>tw&J(!dTs)6115g#BPlUV`oXLd84mM9@f()zWVIWj3Ba3f4KK z_MQU?4nE_Un;kRMX9zBR{P?bPxs)`XUU^zV&Sr=)2VAfp7sPl>&lB!uu_=@pFOu4Z z4b?Ay0Q<6vzW;JB6P|LCl+qgmVnFlK8Wq}X5I;bybE19;JQ!^sZQ1SpN|_D%o=^t; z%ppA}UWqPhEQ&?|0F@TGjy+QQvu4V>NAA^T$Fr$KByvIvKIRPv<9|f2FS|k*i#iab z!H||?}Hf|J2-u507L8i97r$s7gTeX53J5ow+q-2$zf zGu4{#(NH-zIr!jxultQ&DF{+va&n^|A9&=V?=WWEzEI$7;KMimWUT|^^vIZ%EJ)hj zPs3aqAO6J!P(;BARlj)G2F*U0bYV?2;9a=qP;^2qeq}3eGlmSAKt*q4$zc~xJ!>w8 ze@cX>UbZDO zb!YQ`{``p`XB7uA{1Aq6#asl+7EP|am*xyU5L$t=0z767tD(zl1FBAZ&5n1U0)DE9 z3H-Iy`*|ZP+m7-SB5CdV9;q7Dvi~^w*3z$h_~RE|R+G6ivS`eXP2<^asxud>x%Ce} z`ITZ*mRIFw)3cA~K$lmvH&Hkj0pMYo_Qb70#%*k+(2M&5DB*YBY61KYukw`fpB|)) zyHk%X9x6;t3ix^b_tUQ}iCe30|GxXlcVvA0JBSJ8Tgu%zad>F%?JY_GD3ufu6=h-B zv6p;;d*jW5h=>T}y{wsuge80Ev)4}n$4`TKVq-J^`wp@(<)ZFs=}R1>Nq^ygz6%(q zb#-;6^%F*4i9L`3l$NZopZ<62O)E)JiU)OKJUnmi05&liNR>06+4P&s%j0sozwZ3J zru&>%)Z;z>%hQ%t^P{0S=7}!c_vQ*LE!`-CyBW&qxJK+K)D0N$Zk9N*X+G4(4~LOKUQ+);rkif zuEzf<6ZMa!^xq%+^E}C0=sn!&|Jz{yD_r>h*!WB4G2Y^X!^hCQgT;@YGsCv>V`}$( z?f6M`!W;XJYfvpM)oN_2v)O084KJ&N{a$lzgk4#~bR1j`AyS;2^3FZ=(mmDe+0hk_ zcH8S4Rjph~EeS6BDF9+oZ4z#7a6ad zU1ZrD9RF~Z-8}?iA0`?5DvjRfnoKF7-r3_x9N2jO)MA4(6Yx&Ry4O?q&&fCtKH8~A z8!7A5&UZFaWhgJwVNe)8NX9Av6sPI6Sr)qM+kSz6w1}QhPTVK0ELuH%7$hO|`tmKv zC^=KJc_cni#-9EeI6qRBYF%A8r2h(Ui67=O#Tz|;@X+r=P}3@UhOhEVf@5TavSQoR zNN+J+qlAcvuZclwD;xgoniHm_eJ)w0ME2RUyo(@x;CnnvaHzUVeU(!O_bW8|q6bF`YK)PlvWx}j`Y)MjV*cchX=x3ikd6-ln|}dU?_Y>)LR?%lmDotT z9|jplFbh&>xIhl5Hi?EUe(97j@rrnNj1A09bw@;&r1maVMf@y_31cM_L z&r^S|VeZ-?*d~Z-M(6W2TG8Jj8_@Bwcvp3uSR38}WBm{ZC>kn~tp+GvwRcSK%aq|( z`Q65Z$v}atHHE2zUwjOxTXyY;W{=&=$s*Ha6{Mk5p7N2s!5rCSlciw3f8?o|b(l>v{kxr}LD=0tg4iTjnBjUlz{_|&1#Sgqw7GMQUXtb3 zOYKB(fe0HC;2klaOu)>Z3qRzX1?7y@BN$1l>33WTnRsM@0wvIwG5!71bS&jj9i)Qd zsy3CKP3s^>&$(yG%Km+FvWh97*Dp(Az3Gd!h_;zUPCnAVj?Jc=p|XvUHA(_U-xHVx zu@!T@?Tc&k0Q_XxAlV#cB!rsrZf&0c8R%^8hhjk@3>2w2iBf~vk5bv(t;}3`v&Abb zBzQE1%%OX`)-Ddu?>E;^yPq#(fU&V-+#v|JYS*E7ms60BG{cRy_uKr;mnu(@h`Pd_ z<e{r=B7zq1=^~CCkPDgN&3yj$AF%W=ls56QGoV|2=}1iof)la|>NXn6ICs$6gQr zv(|MLxA1XdL$fllHxQ~n^;L@}{Ccr*f%^)T)5Z+hFSe_zC6u6wIzH94M^#~r6jU8O z0vw=IoQc?+EH$&-@nxuUa7VL#Q870{Bak>DAUm1BCkB?T z`}=98b#n8viXS7UwwybFIjwu?^CIkL`Eg=1itPFh;0Qv!&mfC?JzQ~ z3g{H0P6xyF6%F5q7MKUSQ1#=S4SC={MHRGen#+^ zdAJ#HYO~P5Zka7 zc}*3aC(>k@$u^-az%J)#HSRX}ad)`>9d6oKkz87tcwfzonRpj8_s0BXGsiQ@kPbGt z=So)&SskXwnb9|~Eh)x3Zo>n~b!2@uu3Yk4*;V7r3GbpISb6Cc#qF5H*t3LG7hXCo zXnRF5iV#b0KBf(t+T^e?fmJ&DZ2T#Yu6#q;_haSLqN!_Kv1?6|eIe3n7xzfmiOWuR zN>S(5v>Ig+eQrgrr8ix?v7GN;KOafV!}$W9DwChriV1S+rDb&QeVLw}_Ibq>?}&uP zyon9A1c`so8Tn1Std(UW!sMN^V^llxW18rGzH80}`2Njsv>Wf}V2w*aK&rXdsr)HF0ybdR2%rT~s z4qMm_=c(%98gEpElC_!r*O-Af_e!0HFVMP`V>h->#3`T3Dq=oFR9ehWreVCqV^vF0jH1`yrD~W;ce$U2CMv78d!U(H^Xe1Blb{!UL_w6E!X$*n2;Xj#kIkQys7SQ(*4U>hb&0E;f1i*y7S^ z1JOx5>h86WxU}S#PnbrbwU3)6UI~zS?F3&8Dl+KF*b-NYWW}P2PW&C9L~teZ8R6GV zFZxJprVUU*4=GYVUMEr3lEovRr z+j8koz(1@102lub8~kVCqB#s^a8OhwabwqbOtrPOg~8y0=Ti3W?!m*u!@0|z8!`87 z6V!~9@ZC>VRV?#ssN=oW#5FI76bjH7j0(fj9_Ab8%lRrph#Gfw$baTi}rec zM?*B|13tieVWL@`>9}Bdvv%(4fZJ!D$X^Y72OvfjqY@4CgC*laXPfgU*MB5;tUrEX z0F1NuJ&$0!A}xqV98V@R93DGeuQ&+^0AB$<)oU0zI18sZJEK3GW)o7p#l6r~Y3K)B zIBqk0)1~7#gSE#+;m1is*wb|#SoZ$e(+I%3^i6(hEk~0Y0bdEpX5HJnwDE+^-9VQQ z7^rbjW5PywvMCAWt7c#jN>>FarB$$>7}$b8kO!2ix=}{31$`&@594y;y8B*qB`ZYd zc!YpIu|fY$>>Y1Z38br3UvR_Do=kjpy0nGi9qcZnoG#C!?{OXsG^Sp7S~J6YG~!w( zE)XTY*F)xM{``DC+m{%WN3O2J$+6!ySbD~-EXQr9%jA0bG;?V7_Xlgi=9gEKLJj>5 zCyfdO0B)|L3^K)RJ@syi&H}cA5vgk~HMng7B0r>}K>QUsA*BU68v7(9U%#-dKdzW+ z%U(;1{Htk~GuCTh_ouZVUvBKpfEMCNvcGdZq!m(YNaldnw@KpI`=rEWE9;A?kH~e< zwsgG%5FVGPUa|*+`6zBY4T0AP*o_@$VI>c(3i{Cm$YNy`c5y<2xpMNmqA}Tm9-cQ| zFFC=Ke7C?e2xKEG(PDGB)8)R9-$*;3$hlpO<)UMk3w_*+3Eae%Q>L?tIA$DpP- zx{^0E8if_X;+5)ywyeolK1bgtr|l0LXwjCP><`oCFXM0f4){rVfZ%&HM{X~E(s#1~ zo8H;4!c^8zk4%jIv>ucK=||lB@rIoT$UE!nC&b^?0`;CsJDOVpc8R3QP(d*D^8jda z!oaMhi-v^9?ppo+A%s}lPfM$-^>ClR1~fG6Zw%^J*sc_O0-$zD{~(tgeN%LeAk(?2 zn2fBuczm&R*glY$Xm{gsRA0c-aEzf7#Y*QrZny|{uQ_AUejD%S6L$;eBaeg~;nL!N z8>Ix&+q_^G%E$d%DmZK8Xjfcwp2Stuy$Bd{8HDFzmzeIQ-T@pb&K7l+y2*937raQ! z&4Jj#sLu4J=09h0U#-JVXG+qcmh`biIqBumS}QC&U>qNjR^YWMi#^g;u{<=8u#g$Y z%N8i?dhTn<|0#Z(-s6YhdxePr%!)uvYrM$Y?wu%NNSkf>r2X=>D&b-;;M2KGEZ=oM z9Zs|=jqVIydAfHre{nYGvVRiqoK4F@wqF&Kl-{R?>DAB8wfN(b%)7TpYjUY;I9L%s z+%8mXSRFfno9$NG7`gzq#?hm})P%OR>jjP2-24&h-yJ0#u<$+0Wu<};7hV1Qmr)IO z2Io-}NB+m3vTO!_SWdrE<6(x_r5kF=X3jhUe9K3np5Gb*z=~Sy$0O3)qwjdzv$vR? z=U+_Be`am}4UO|}8k@cX0LJe-)gPTz&G{j-v&+!~iuG&cfr# zH}TKv0B*i{JO4$S-1@A%^ft8>X|X&@v;9z|;N!1%<((Moc9&uY9A?4nWo z$M9QrCXYLt+iG*Hw``Jk*b+6?<(&I^!F#yrpvTFtpb~y_Ty@i}u`1Sqz~}zd_2kIt z=XXAw4V5{^D%79+T%n%3m`&HwnNq0zbzDxf3-PCT6Bu;9eVh3h2Rk)h5o3|r#5`pe zxI^}-zJS}`nQ*`V`HJ&i^}_=LKyh(dns>3W?lm~|N)srlQt$iN zU;O&zKXevnz^xA2y_>hBHb>)PcT14{C)CL&0T&~?xrE3I8t&hi&nw;$PZ|cglC6W3 z$`vdA+-zbS0P>REC&v1UFdL@G@<~w%(eYKQ6Ki>gUY&cYY0$~M06^p*Zis2V+8q(p zq)5?p>$*7T_2LMKFR#d6jb}^_2n=sj=1T1-Gn%glN*xqgo$Dt^WjEX4L{=(`swDH2 z8iZ1>WvO|RQhHvOfl2B+JA1Z|yMeRls8BLvX!b|5ca>|^`di`s-Wmvg5k6O^sVF(QM_lln zecT|Kz(8H4?+eli+1)BL2K1G`+-8R4e{Tu4b^AvIE%R-&AQ*yFp86#rR_O;#0+6q}!Jwf;2 z5n>4vJCFUKQm_`FH-_?qnU)QESvjXtKB#eym87At2(ckNZ2Z-eMoU4~bYoc}&MP9= zet+)413}PpuO9H^(2Dd}kYX&YG9lZC+#__4ab)qyar#HFhE4L^R^G@0MG$hRa7x&0 zt58{oyk*T==6A6px5HC?lfCL>Pbh~K{ZOo($$c#cr!69nPM1&|Ztbw<*Se-oa>WsPxcZUHH;`i0KvqF(o^`}V7>li2Te+A&KxJF=)Q(`&qNU0jwDG9G+Xlp{qlWE21K zhXS;pEUukJo4Z1(Xvm0)xKWbRAoW`3lIE?=p`{!{{rdo4KQ5B9cf!%54$8z$QdHGa zrB&_OEsl|aG5JNP5m-)D0A+I6P6ggpEUw=T-2}*DmZU&f7txKD342zAEiwKDP1jP( zQ6y<`K|ymL-;1s_-(+xsgNnS75?kNs(lZ4hOK0m$r7LPsunPP`T-?tfmwLANnivMf zF@l{5q+&yK9Id&1?Ytq%)@VMtZ6znId;|MuS}HFtlK4new@k`;{M(~n5E(V*?im>w zUEN_7eQHt$^uF6`=CY4`h_YTx-mLU5MzFLyjtd@6=n>RJ1wWRDcAGaFTm{u$g5M9F zu%8ucv7-7VMD3V5U+k3f#RWQ#J7g82i9hS9C~g=)4}$wIDj&}zY1g7B9D2OOUPi3f z^-a~)OsFzS3HEL!G-o&GOuHo6T`83$fMkkQkO?+TJ5L_DsZ&Uqp{6ER+=ys{+F?m_ zCi3#IQajJ#j)Fq}lM!RdffrP}5^vM9wV5Cx@57;V>J9$ZdYT*N{W5dFIFQtSfr>b9r$CvLJC{YVR;6 zKc{s(<=40;mGW!1gsDs>Ipq5j3rvQ>M=3gra?40g3c|iND9E_8HA_9ZtZG7U9Vq1- zWSEiy;>Om*s6_F%HYey)>3Syz=zaStZ3E;+N|{FI+$CRp?7$ig2PPoJTxKj!9vn*1 zTN&KOYwfquN=+&OwWFf=+ z)@1ZE8E{D@H{2GnfLFkoEVST|Ooh6?eWK?LbNoC>e!5iG*i(rQdxR2A357|!WjTn99ote%2_U~&nQFH$ofZ?M;_A|WRWZC zw?&2Xxz&~2{1A;d?l4!l3)dFHNhLOntZqP~Fu;yh5|$U-JC!XogeK?%WVJ@;6QnGk#s z4((chTii)hwr%R54Vu@@eT5ixOzDSWQx+D4+sazXD&V2ug7kzw1Yb>k#F8hlYx6e8 z@cmn{CD}|fI%j#MlbE7+Mqs>&sX6lmGFS$x4Y<0Z;wq!!`aNan8``$av)A-tE!gk( zDncj_T{{!bF($mLKi6!NGWE2F5ey?gl9xqqa|bgz`vsLdYA+i~y%tKIQ)BNZV`HLhQtb&~4;y?2@x}M%b2eV?)vJOFa#c_=P zR_B0+3Y>M`8m5-Pew9T8u?*g?A*gM&W{V}a7I;@BN;;b*Mt#5XpvNz!n4Gppc5;Jx zj*5b|@v3sc%6jb_&JB{i5u;vO8^y=Pa7K#Ej9uGXF5`l2R+DQDPZh?VVQU#VO_Nln z)`h2r%zjkL)ch9qp7~0YY#gv@#C{D*g$Nvtb_k$gE6Q7*kPSMPnl?Mbp0uK8W#c0+t-jhVS+`nqj#|hfbTb_>m|$k{Qf*~8 zCM*9H!B?0Ev!31{DxdQOrzcft$CrN$_d~_M>7NGsR=fXEN|@V$zJv;2UH_qKuN5mS zjtXVBaxX<7zt+@UBPH84O+wmZDhe92kN&bMFZ1DR8VoeFXKVHl5fPy=6i_w*2F*=P z{+1A;_+s0%RoUr`Zn;vjJTjqw8NJ3_m8!wZXH(y~da|d4omF%is+k#Fb}_URH_u8- z?2f1U;bxp)BPN;5CUVJg+3Q86(Ia|URP6P25@)0)7?V!!U#MXAwQX?;oe``nRr4Q( z#NC{+7)VF&^Ue@U(`w9sksPgik#wHGaipua0nKlf25TcluvgKHqZaRraJE;8O#0Rf zhe~puSr$4hooWMZBNJ)MZwAX3>{FnJu4e|}F7Oq6cjTB>Rnqt%h6@%Mx@w=3JvwI@ zo0XNLq0juXZ_+U6%JIHkf%EyfJ`nhlr6=pm&_~7e>W&GY)nb@8e5Q~z6er6ONfv#U zfy?*(G_06zIsMQ^Aw0dgo-=rr>0-E$@Jhubm}k_w#`bps%EzK7Tm@{Y&IWr z@DTUY0;Q`&MEtJ;oDr+t!)Tj=;JEg zzI7}yQang`aTqOE7xt=cc{FwUJad^hX41Yp7u@$on@N38%s*v%llflEBiW@{oLLp! z+f}Em&B%2O3-rGOGif|wEMhGyi=)Hpd%{L?zMEdPH~xgkGD#n^L%i_sooSaS_xs+t zNsKi@$lEB*ep@C)I6P7Qk{9uFZ*g`on?Fkj?EYR2;p6E0G;v#<@|Fxkn_H{_0C)Os zwF7arTQ93U51MiHV#+l3s+{<7&+48ZV-@78m~o)te@UPJ8{G9z0D{9=#PSTTp9BO2 zb0H{PR-CnoC?iJN*Zp>~Y$8yo&fZ?Gb->2@dRj_d`IXo!9GcRE=Is#UlDePj53hD^ z=7i=hIb1*a9+#(IT%X*SUU;hg3&s2caba;Gi{Y7>nL?qm4i>V^I8=v|cJQjWse)a&6A~QZ z7&aBAQ0kvJob{877zfsza8PM8wA^a$d_UpF$jZuHLxbcf3(Op=q2cbg8vwhU=yMy5 z`j7#_J*!q?*!^GV^xg0OZLz`sp|}2DC$BGIxZ%3FDdTi}jyt$_JG6L!q`OsvIZ^`h QxHAAnSrwULsdxVW1>p?zBLDyZ literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/11-defrag-preflight.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/11-defrag-preflight.png new file mode 100644 index 0000000000000000000000000000000000000000..b0f54dab03ac60112d1e80066b35b5dc61bad8b9 GIT binary patch literal 62626 zcmdqIWm8;1_vlL!5;Vafc#uGFcMEQVy9W>M3{G&DFt`SHcMtCF?l$<~3=D@n&;5Ua zQ}>)(bzgPYuHN0Ndv`DSt=?gZ@{%8s36SC7;66%Ai7CUuy<>-iduxsO_Vr0#i^C^4 zICMB^F=17=^piED@1VP9p$jI3%vA*RICK$i)WNS`z98q|*jdfV>FDX`wdx-?8^jRX zG*+zn+BDW5x74qB*wzE}3Nu_Sbtb~Y!^yw=XrhorWI=ip7t6Qx;*F^oZLgUv0d;?V zav^gcw~IS)7s@)n;wR%tSA>6+01nRoo!@`T?~}jmKm4nqi+xFd^REJrfoT4(gcFAE z#{XA-NB8^xt_h|$-s2&=*fe_7cXk5gook0BZ(FYEyFhLMGDa@P7E$zn62c{e?fcE| zhQ!z5i@BJVGI++)zFiFldZY3}$W0*VC5h;!D3@dS5Z|xPrSBmBnbhC-Ahu7nc80;8 z>X_QhJsC;6z3*$gBAp-Upjs=yYy8N-wXjuvDYO4{A5Vj1KFxf7)wqH;=B!b7@#4ZQ z!)Or^W&erfuT-wx8cxnU{2sm?>ZQLN8odg$5;W{iaH*J;;@``^&PR6#a<#(F!hMtN z^bX^K@5ZE0%FllYK@FPMc=9;=$saL6{q^6pqSrf(mfvL&AVIVzJr5n zqD6l?9PL}0*={O2I@D-gIsLX+ougvLAd`S%(b6-(hrJZ{7$8|%UiB{31EkeqRGo~G zV~-1pM0RR#R`4j2*mTVO=$>JV#+!$F$_^@=xP(2L#?M4G*#bRqg(;xQyXzb4Msk_` z`7;AiVWYErFM7F_O2yGI_ms~s`0bAw$l!^0onu&=LO6uam6;wc^~nV3WCr#xe661} z9y816mhR3EY-M%~k{7>KvMQ6_KaFajVm-|cD)4ff+9%1Ig9%Mv&cmI54z15E9mJ%nD|YjIUPb@jMyqijE5Wf71` zNyV`dpuHT|o{Gld3mDD&&$%g)cDO&U(cv-3h5q<6B3b{pWKXCmCiSF+FL5;E>)s@z z3jvXZI(g&sJzk|9v>->tK*d-7_%ZWq?Qw+;9j;`Imp*w|7gIJ3Tgnza;B)^ER$^Nb zG6!tRG(moH+v)0EjPcP$eN(>HauAQukh4sm#*t=|Siea~pd<85cV9Q|C=~T(Gj7EV z1T0F}lba1luA}E6Wx;|>!_Q_x>ezV#$fO3ZTtre+W#XxNr8J+XJ2!m2#8dfa7ubd{ zsYlnYUmtXA;1%}!aC`~&y19B;hg=6+H}`VM6!ClZJ(^l7+X{-j}=Eq$V8dkuUUaeEF>I78+MYhGqmbSAN5|Lrh_9EvVg~Vc!ln&_MJeyOC z$33@X=V7#9C&*9$y1LwHhjebvX7SZpO^i3fpnG@;dRuH}dlHjVrexex?p$LE+lRxQ ziw_%(9g9~k<+3`1mFAsaUVz7l3?b zkb#Jb*>nrXLEiK=WFqZ@f$)(BJ=7EORjO{4&dlS;F4)buWQ^w-db=sI?TAk=DmdaQF3v#(O< z37f+S9w9{+egg}=icFl(=Z&4-`MPaK4+rPtxPki{FNdk^cV}{+Z{~13&)Y4`rYd2_ zbeYAC>%bkRJN%+I;wZ3-!ACLh@8T2Cfxg#ypnj}g6JXUu1nWC8!A}E$j|#FHnyu>P@UE`5ui1=CYL%ACLC-jGkZA zs+L|tv2P^qDYh$rDyWk_7J0gN=gOb1YrnQz*EFeHASfef<9B}qwE;D3zOP*A7#Irzc{r8q^RDD9yL$IaHh4ZhB?k{ zQ=U%Q$phJp4(PQ^Y|sNd;Hw^qA=cqFgpVaMt1{i2bs?)te~0e5*h5lqMu=vVw-?OEj0Cz^;$(PiWV+P_~Ix4 z5se$Yf+yZP$p{|#8HUE@r^1vVr!`8Ow+HKKskEsc^CP0~ksgqczR8Y@Jl4vM;v*p~ zAvp>+q!Wl4_~Z=HkL$;tLrcxib(n1Fl=!CTD)(_ZI%zPFYLfQMf2s_)sdd<_4B|)3 zB;rshqMcCddxM)N5@ti%+l$}oAy332BzYkMQ(hJH-@A|n!?OlQEZi}Nj0&NJJT9oh z?v3-pnIP_EF6C8)9qmU|#vEC;1EvVhEWt<9_Kbx1lvefy*v1Zb_hhm^v-TL*iv{OQ zua?m0$OxE$cg@>kpeOxsbuPurjMUeXDt@47po_-^B_AVZ`ZY1 z2cnpRGgfYgu}Gvw#z*j|6}{7WE#W?>e7Thr0O{L7yg7+I64w1NQ$lGF529{Lz9>qx zaSMB^fY!qpe=kf~0cRX6(3K=5P;q;V8}&sRpG~7*eYy?4@o_Ly$5BQCrjV5nm^FB& zsN!MY*&A9VTYP9(JcVj=lY%U8X2!0OAyAl1NH}J>KpwL)t3PGiAJUyU{%AR~?OgmP zrxmJ<%wKkRj|lWUs&265KMIG`Iz(W`!QTY0PYqnSY7i}|_aR3_M55K{PMEcxNUh=H-IXDDJx+#`FBiF^f;DE z#^_{TAlvW1o;}u$x}Uo#1)OUtC3;wrhY&M$23>ZP@fnk)dvu+(vpS{rk(@iVCd6`s zMaxyeO3~>licQ*IBn8C3?tS&RdAEc#qA^k|C@-mk^hrV9ulR)@&QFv6$Csx!rr|g+ zw>@STt$vRL4+}9tC*BVd7}S)Z_#sRjSz3H^A0(75#jY>};`${)8TGT~shd(?btMZs ztm2J7d@!IlO-TYXSczafj_IronH$y)gV ze|LBD``aEUf*#ASQgyD1!Ds@CclhI8k8-Ss+~6{H^cxYYJ%d-waA)qLRf21;(gV@DNbts|%<+SjRU zrtj5>((zlxLq<7QaBd)4xe`y4O^$6(*12+bNaNW&eD!$y4>*n|GSsP`n8_nWe}-7| z>)qh4mk``C2f|vWP2?XPG*OsHBl6-O>Ehltx0a{ zV4;C#0g|>8lNVm*;G7?x7Dyto+HEv3uZ!@=hNWqKM?_!!9M z{IF%Mo^xPcO3csc=-H01L`;0cSMRa!jx|?%bQ|afRs6g#XF+BoFT&`|d8}0z8!Kk< zvh^J+0~&Kj+}S?0J}2wcOf`FOGP~m=3w5kMw-m3h5wV%(8%`q~piSkzC z6}n1BSx+B#RLos#kE2>SCMAmGaGzSdklHZ%#)Xpdr|r^VvI(s;;JM|Q@1pwCt$EMD zl=_LcZ{$C(Ez+MtemK0USbOD$F;O!$ncAF(w?$5$Hnw?b6}GttF0%#d3mFG@s}|RI zIM@Y$^EaFW?o3JBIt!b%6}N!!(|BYjbsUzR!}5teJ)NkBQL;Zh!qL`YLj{r4Eza0y$ z7OdqcXpeY+rfEYT6)QoT%=`{U2Z_ey7#lcDj$XOgV!^z%J5ajTDQgYBE)QE2OBRgz z^{{6Ero8!{+&AA3Ibh>GIc^yqFQsr^y-oz6<*k9Bg?a~YqotrV)7{J1=dDX8YHLTa z*SXFF?7<1tWVZW1EZ{2#;X!gGxypm*1WXGyN-=`PxwhIs>cwnJA-m9y(br= z+nju^3Ns4HO6d)y+REBA+6(9UhDjCQI*ISgsA|+P8mOHFztHpP*SOhM@3_y$Ke|WH z=aLfJk?JPaHYE9s4eK`?_M5^Y$YsIBf&)t3_-Eqr1^WzxJxqLZA8h)ja*&@*Gbzqb zEqP&C>(_nF?m{vJ`{2VY;5~3#!~_|4fCNPu(;E~TGp^@ns#ZOp4W!=pY#m# zPK$K4svj040cNM{TcMnesxkF81{k!18J^~hNk?_~av2;r)B(KdA1P~9K8U`|Rowdt zWvQv*0D;F-vxr;vB2%V_d$-RJ3FtFj1`%!zpJ@2;!>L}R&c5rm{cU4q&T`Z!o}Ep{ z^Vrce^TCAOB>(MJo!r$8AtVxZHDM_|j`Cvsa{dla*jUqM-0A`EAEMDEF4D1}bUq_+ zM#lS0EX!ivML#q2GVf|Yd=RBq@*1S+=y=Lh+L7M2iD81$`Hu&G6aTc-wcRT#>Cv`C3#gV9S0T;)_04*CtjRCSa3OT? z&APFpuLJ)oeG@?1U!T^Zt1ltumDrnK!ljosgi6TZbL4DuPnyaKvac`bBZ16@oH%K3 zb8+#BWqZS9`A-yGy{cu+>Dy-iij$xlBDtk>Q*!NT^r zW^1Vonpi{?I4kmfT8-^jr4c`DZp+4eq(I%f@PfiQ?Wi8wWX9=`4 zp51AcCrPf1)f}{!9wy>7iK3MMz@qEisUy%0UlbWF!>K*T(w}Viwr{LuF~@24j`3?o zC`S!}n?g`Km*8VRz`iiWdB%bOgWP}E2AnRlMMACcBl*2I%XY_;2~fX=nqnPm{2V%A z_!!2^D!*-73q2w7$n{g#_hYy5R_*)vD*tOhnH+AbtjiJ4?|z9EZ2bN!3!@z7 z88&IndK06M2eP+3P}>pj2Hya=3Tep^wFH0On!~YMuQDBe&dMs-`@CPRPZfb4k!4F z%}oI*p0X(uajnS;V*-iyL}<;K2dsXBA<4iim?l(ur2hrCqVw1b#TRSt^YG<4amAKVd?aTf^Jwe|r+$tD?sKHp3B|kmU=J2K~K5P>EG+qB7X_T+Ll= zZPY!lRN_(n`dCcA@v%#>%-utgb%u+WNdug+U3c;%wxQf#<_DRd>2Jh90-^H_rB#4WWIN=07$omHM+xok@+lRf@ zbx+f)4l09{P?U3DBRSvo=~M5sb%XYWjSSjh&&~SAtm}H4?Sg^xWi^;}m~?vLywJ~? zeNQ_tSZ^OIz9>3_IXK(;AN_{Ur&H$Xd7tUaj4Ii4n3y5|K_JGE5_jAD^q-DtL+DcB1bM>7r%$8to*a%!n8`~5z`m^EQRP5_kSgaTH?~|ja zR{$ERK*e+$4G%MzlIs}?WrZ>_WhZk%NGtJj+fQl8-a`Q2!)Al_rdr*Jc!VGG}5dXX$12(#RM1V|)mymlaWw;jd3-f`Qop`rwtdZ!C#xqEzp;mf(VCCWoN|-6>Do`Pun6-HGK+Pu`9R1H2{QBcy+MVLDqH?zd6YQlo zXEeCtcTu8NN&jM=L$w>heQ)Qd`TL84;_--;{7KJ?;7v>+lj9(lAk28T6zN6oK?ecQc6iUo@7It?I8>oLjxsO&p>=j+DaFv({@aGzeFq-hXy^u|e*2R& ztts*@G7DBQ(fBRailC&Gt+vkrxV885St`!;oh<9#lH;4&FdC8~&Sm1@Ev3mV=8yb6 z*!L|iYJ3JyHi=L9a%>;^jUHsff{xEyd=F~TUT#4IhfDvAgZ~5$l6ecnd+!6-uV>>< zA|HXOuUN49Jg@>CXvJ!7?eUnEmMQVc+t~df%)8YU7bin83WG{4sM8yo(ORSR#=r!* zBfv9R?i;jN0sDau?=n2?G0XVT!!0E|4c4)jkF)(Nm!+7)o|{qE{jX7Y(eLyggd+n? zkWe8{nyY|!&$`A8a#E#M!xz4fAZV+%7Lrw_dq=_3d}F+#&_BiKKZetc#J~u-9*Eou z>tDJ)>N&Q3K5gY2A$(p6qLCjpfbA3-Ku?|z7R1;j(!QuvKULg34*@i;_nB*YV^;wu&0A3#b-ZCk>5X(f78}5pNA3 zlb1@Uoy2ba+yLJZEd@3jJ827)&14D)gBm@fd4{ih?6vpE)T(?@kop`4LEVGO*FBK3 zUXi+)sBrpj;wY^b3~=pTb4jU8bx^IEZMQ`!Jb??Iy29qm)YT79-}!bik^hse>s!;A zQ-7#F?0)7r1;_JlOMjF=paSP(%Mg8nfBL6(5(G5bTB#a4ZC@-)Rvv)dp1EAG-`P~% z9C${YbPC%kc@_-o!>Dw7dZ6wNA=cuu(e^pIa^VHMJH|=vbeO3ruz9R& z&Ge--|M_bgul;6w{K@zJtbj}lb{%~Z)pO<)%;5t$7*ow+382xhg8A*C30^qsG`~=p zb9Wc)F`ZX3EzjWu3|swYISIO4v9t?bu|H&wj#EJJpbtw>-=YlBA9cin2vXE zB+JW!2e#3maHe^uJJkSzIz4ecYF|B>TV1^HI&*Uk72dm+e%KptmlNt30lq_Z-&#|^ zQ%19AiE=MCr4fCo$mzdHD>~+S|A5xf4iy&D^DB0`_i;UXTWERUgcgzV?k*dLdQ>ly z*^SnQ&ll?JyUukj0}uwd8Uk*smN-tmtf2uOK~?YSAam=1db!mqNUX3)L}H6m8UeFN*&1HUpua?;AQCQ%QJYa+;fC*t{@_p zZ`M3Q@L{aHQLw&J;B$rk``1PPYfnZb|LtEO^15Zn?iv5tHYFo;G+Fs#Rp)A6};_AGG&xQ&V6`sT;cmzK1Un1j{ie3W^J;FYSh-*{c}xS zx^9h&Z+`#si@B}epq84ty7}dH=aGM}c#2_aculaaT=|UUUCtK~d+d}HWaFDI^^w4& z2r`9QQkVG%1&>qVCf9{;UW(PaY}=EkcLoPn0JgBFsnGW>;?ljF{HJ6Sf) zuRmC$H25Z`Ad{Z9y=G8cAN_gMimPPyu!g5KO1)C#o5{~IH*;x6a`(WQkyvESkGQ3H z16j;(Ml5*k?s!+1C9qo5c>oKLWxb450bUohf1ilT8r;1E*SJ(vtS*Z?)N`LV52gwV zFMFGP`Jt@JU*p{nXv{q zsbmQH9~NNAVdj@!S^iB~2SFqBgvywSED7@2G8gm%savs8Ms~Q{jXr8lriwg}J}G~0 zx1ZQoYXQkcJi(G}o6^io4oKK4O_C+d8e1=?W?*`umJvJ_-8A`C+&=JS6xQRSwYh{uv)rIOWssOlsgTit2Nff#dmn{AhzEJQe0*@Pm~ zbD~e2ItbFc%Z!_p)SNYipGx9iCkehDDX~;cmYgCQN z;A_fy-BNxDJ83WL9FNRWh4?0apV;Y`%BLYRZcLgmoWu_-ZLKfUHzrcD`KsA{6c&CY zLW07>=TcH5VH1-^COecOT@wC5CK4dMZ1lbaqSn@*o|M*OSRI?+H>`p_hQJh^*`c{r zE@%}B=(R)posf{W?E)-`-@^r~1%Gk1jiXN$U6flcS?w!H^8XmnzKwd zDdK0)2-l9Mwqh`0m$%@rS>fW=OXe2R+f`gRQ_|5S7q?ZWLPAT?x zUWtN#%V-GRL!>|~MLrOYwl?!hZmxcep9-v{G5Gs=`Sg&pgzz{ppoPPM$y|FMka!6Q zs#zP6m6o9yq>NE7x=v~-{nX}~`|Cf!tjIRlZia>!g!$JiUef_5gKzyNe zK2bn;$={kh8PLtGV&K|8q(u4Elrr_2LZ)vve(JAw zUg1Q1O87||%nzM0PWB~8aH~gYjb1y%Td(9y4#6~KT z^_bQrm#>-mhm`69GMOW*EafOl6!d|W75E3#mL?z!GDY(bnTiGWOcu9Gwx*T>F5YI5H%TVqff#E9a$FRE!7t5kSAQ?B9g!w| z(WIXSe#l(0u4$Rnw0B{Y-?Xt(Ee5!T^eL)sERV(YA~6bxBj~nP2RAm(E;O=XFYKAg zQ-3s#;-yQagcmIsY-7w+R8!An*~TU7$s@1GzlmI)GzLB*m%2WoW_><&wcas@O~OknzX_o-;gMT&<2tFg98qnfcb`^%AFpi zRFqalD)(HsoW9E-PUttTy4Pc6b}y&s^o(9!S&VxfYllPTld0H?+nYo)s&w>t!Abf92HAjGr8DC*;i!hE0?$8QokVeoH(z+PN7NDuGHP!Uxg? zC>TBkc$HY0l?k!KfrHaFF0Es0xT%U%eZ&xSSUq;9J=q08#b52J>4ql)f~F~ z0(Q;|uC${Vs93cbk#1b_r1w~L%Pm;s=7+Y{_1je2m^VH)OJ%cj2G3+6BPCMON$*a7 zi&3L1Ei>eysTpc9Acz_sOEpdybJfxo&WR06mx!8Y44sIBJW2oj6DHxg{(_+JJ1_R~ zGZC2H2cul4l+?o$*{ZQ%jc!;`>JcyP2U3q4;DvW3$_7^g;ML}DYR7WlN;i+HG08d-aOL+eQ%>!Z zXN6?mjBk;KQ#w>6wyP5LHIctr*|>xd6#g2qYOleb8%Gx1>No|d9mYL2=2C4+z--!{ zFPZBx% zdK|{a?KwWF*N#f1fQKC*ClSm<<+kGYa)hVg;&t#F>_I4 za3m%WY{|ddz?(f~hzn&im5IXA!+@7`)k|z^yyd%}RpPSGWMUyIS4|^}ee>#Q&CFev zvQkPeZp`(dj~M0a@9er2SJ>NxEtcI+?Ef0HJ0zrO~s%yyHSS&R$_{GO=%Emxl5io4uH z&p72%3(Fh0P0thX@qa;nQ?MTKTIy?`uf1aZAIc^CZ=v@8-^dbs$j9!aZ`(E8eUws+ zq5NBsTx3H?A|qSHsz@l8|8_5Xc*pc7tJht*hfSF{dTMyE9y9O}yoaxa&!QAJDHR6i zcbUGB!s{%smtezpr%J+L@rs8oGEn|y46%(J7U^uYYHtf0Da93bFswO^m_-gFW6#;~ zJ|KlG>>)d>Jfa;(u-ul`uLC^JEOF!zh&@GlM^lQUsOIvGx3UOEoZbLYuj|?Az zV3La=Lq)hlH_4e9?U-PA+ehSWkI@ZmcGirKZaQIe;D00Qr9kYd!sDJUH+&V+3qlLU zYeWtaQLFBnQw0tPRpk_HycYjV=}k9v&6I$ua4+2$DCzzE{(f<-yh@i`a64OJF9Q&? z?DQaP7v#GwI$^w-s~Oqkn6e&7RdeB5zf|{>0;i46eSlEfsO!JZ ztV?Lk;f0@I0iE>HSp(FIJ^GHVYt#yv+^#1@%I@m)(SN288&_PmveZ|U)LnU5m1PQj z4IaPaljU&(2D2CiYp#A67;JnNjh-seSk15K+rEDLrc3w-f0Lnjwn$eX0jJ4`kZ)?b z3krEYB7o6<1T8`)ZGZ97v@hB2HF^j57bBZ5l9_^U|o*n&fVQexEi?O3aDO44@%B2sZheFFLm?R&Ay@pnN$jb}yYN zqMM-qTBz??UUHo`#8Y@NHnzkP0E+8rx|^ENXGD7Gd?`0zAg#`!x~UMtemOG7gMY(%w(_tUAP2khY$|prg;icOn099$l-$ifHMY^zUj!(`<%1Tf@x&2* zA-&$zwG`U+LfGB&}Q|`{kdlHJfugPq00Nbp6EcTOs7Il4PdR12`s<=LJSU zpc}&r-lg{h&M;j8vTPo$uTuOD?jbMGjpaS52Pi3>(}rFrqu*1amBRoCZSdz#rMP)z zea^t@nla0b=1BVZLs&Iij+mI#AFuuSGrr6DjZzsaqDWPXvy#!Yb1B(-##UKkVm!j| zE@>?RD6FtXh3Saj3-mbF8a`P$FBHo)?6?!${v75x@Kci{>EW7b{<_*M2kD~e!f@$Z zO0^sQgpdd(X%n-)-} zkLjy2>s9>F?e85k18J}Ea;KAph@;n^^*tFx5apkfdL37jZw+u^hZcjZan~EYmi%*l zneYWa8cRP2g1#uD|D*wcf#=K3X(`SxX;#SCfQXJwiaoz5>v==POZ2C(rlyips z^?REm6DK&d!S68?D&HVgVxdq2?

Q6=LKDX+{V5Hh;a-RW1e3wXWM4l@04fQ-zbo zu6Mc|rt$(1ksMzdU}&XGXK5K=mO|Fw^-|$Vk)E}vt4_`(^*xJL1{@T>#p9@Tmg$!3 zX8H`v;4;<{!?Aol3Iv~``zkx=4#0Ey)Wq@#`k2>i5H9Qi&Fs}Dugffb%r=N_ccAe# z{ARFRxExWgVG;u%Dq8jq@TYLm33de`&Yx<8(OA|Eif55{AB?X?O0nbf_pg}?KDKjQ z0-bENx+Omzl$Ppp5=~F3g>4S><}-CL?u|Upz2cdI(fGjH^zODv*|uEFvo6%j=8Ms) z87p|m+}+SKTGB?6=ZVx&imRkw@{p|5Hz|9om3P?vw>H(ds|3K4bBfk4t2V6)Cr(sP zk7HkJ`(`)zh1=N4eC`$BZk^~{p}3xxEAe~~$DPSW5PX>NL0Ep?N;U7j^W`;wUcYg% zY^ohHF`;@gyRxn;J*@9sm;*~c)I1po9y4WerwWojn0(15(_MAWJ@uwuE{SgNre1%p z^n6eWdJmy<=&X{~LJ3(}Gp!y#dY^4gYbqWBaX2XG+d@VkUrnU)P9opg;)^S`OyPFF z`Cgf+veEXOk~8rM$kR8iHnDDh_x6q2n>jAu+mM`zTbCPN3!1x%hqcPx_H#R^FGsC` z$M0d~#JG2z9${Yhpzc5_T@_Wyf;bymtkl~3d;=s}1HSut+#7eI?lYaI2LW#~hv=&0CeeZUO8Eo9K7tlm#`u?udq{)v>8%b%soRd?$K zA39hU*AiUjifs2QY(g71FS`3~_c3biIbe?$i61h1ZBM6z#3q~*@m3TsGm*u5+uJS@ zC&70xy7oJeg&Si9?H(bTw#Lb@+#ye+yEmIafUR}?vd3YV!fsh7O}wC&9=P$jExToT zBnz({T*-DoIi*|PQSErtPg^>M;Z`QxmghC)GW5?8Q?Zn}T@SB2vSy#RDShG@J-*@O z;BWx~ccSHaGX$OX0ZAistE-Xyh87F1Ebmcr2M#}VU6!`7(n0ZxAC2GW*UuAivYPD| zgimp^DRXe~z@y*4>%~sXLRlBUAq@S$0zCJxBbkEYc zc$SVBpp5R^TxSb@nEw5V1AH~zejO{=y>s*7bNud5&}u4VAyblTBQ-It|1_&fv=bWE z9+GqA+eob+YVbU=zLryejM>s4R1M@}gD!Zonn$eJ$dQno<&&6Vq+32e5H7S|ho^@S znd>j#ss~+H#3U7dx$%W5UTfEFa+L=8Ep!`}2u#arhy}6zt}O=dQG<`}%AuRQs*g$S zl>%L1tNeTt#G6C@g|?b2>}HKr1eJy}DyBc*>aADYuJIDqG}hGwLMI4c!@eCLrpM|h zau4I%xXv1Yq*dc{$D?L{+t-=aPn|^)jr)SlDwNL2D-$yh(mag<1XVhqO>_IzPIcRd zcB`QbNUx^BiD3|<8&~b6QDeb?n{zKcYmpXEtr^!k%^*}XuU&H9p;~9=-u|En1tcpDTZxz-uIQsS1BZ^@{p#Q=V6%yht}m;0uRD|A`AolbSCv+%N0 z4*QC+@zR;Lpycvd<;XZqgI_{mK(FN~ifg8SIBvC+Gzz>0ecRrsz34#$-0$E5|VL zJhesq!n0J5s-&=fV|!~|;@=mUZE2mG$=4e@qEQ|PDdIf*#=AZ4Z3*jUUrm)3YN05up&bWw(*$KSQb*U+q`~4h3xOcCo`8=|^1EiCk!;gehFr$tHrf=%} zVIfqf-@ePfj7u!7&uybNa+N6jO*4jU!^DKckV5){NJA9rNpso}GFn!SVrRfx{`!Z; zMM3;~0}`f6NBZRG7f9-gF5^>Y_R~+WD}RO3zI4QDvZvk8Q@=aaG;{T3WBA&v^e_}- zQK7f&TTd9Ze@Z;qhvEWHBEt+C%qD0wZyQ}|ZoR*gEh@-h3^!?LtZS*EkW8boHCdhgXY{7y1KBcvNs?YQ z~qVO*l4qf;q;m$jT{=W{m|kY60};$?+xR~MGMu5wP7QHrZ_G=_cX zLIoNT)3XHkT7DomK3l9ih+bDwu=BL~GH{*c6b#LazabTJ+T`eK*`Oz^M-?}Z)qSzB z`6QXt(dc?-ZUtk#ATSVISUo0qpmbq%_!B%({GMy=rxQV=+GQq#9gGylMVgYj@pL(U z`eIr@{~2RESv6*>Pbh<=1S6T!5uX15^*#3iYScl^!rPlA_P~8#p-op5?lW`^Qe$a*M>y?ch;Q55C&y;D`@56CsaB+AYq@Udp>PoNZ`I!Bt6t5KbGU(9e(Dcl%IH zlfg?k&&?>yLy&9rWjwV^!e!x-w6hu7Ez8#98Im5I zVgK^utuW<`!}?|&yxVjD73O%q?V{ovLX4e2HqQ|s+0~MtWRBu1T2r;TsrpAhCo*sa zjLHlT(w9n7U7tFdZ;Sc>-sFn96$sVcc>EacH+^hOosO9KvKr4Eh4#0fuks};hnu`{ zGCP}Z+rbQ-f==|tUH;jP8mP=DVto{@yZLKMAtuvH&ngAg6i6C`ES_vunkDNuJ@^Tu9kiIcu&rViCJ?(z0*Mly_l4mU=vhIPaak97R$#!`WM6>AMiyiB zVCS7L*zuz*gPaBsk(TDMeGa|pH}$`ylK_}CX~sUBqzbL_Hua1+fBOr{wZCa*$ldtq zOkN&dbk-(nN9Sp$ch_GI!59HJioZ4C#3vr~tuGL_1Dhfj{n`8u+J`LUOspInvUmby zC>X8XFFMhw+LcPK2A6i>>!lTF28S zV@YhN+_Qc5oi_&sxB19^Kz6rD+pAz_b(hDnsD7`v!`-%^!!j|SvgP*znI?Wwxi{v_Rk*_fVkW8mVQlfun+6iflW^BsM1Xa%Cep5q;B!rao<4MJbio_9ah-c8F7V7jlG6F z)lSP9<5|w=(bbSdja8@G8Tm4)99Q)4N?gxKTF=_>l=Si$jY}gk#HO+eIwH%^`1MPL7=S>Lp&lCPbpv7_I*XYa8k zN6vaAO5lP$j~kpP4=8&9XG<1IowxxU^)qPkkTT=7gf&fN*ivE(Rr^ZuLe{dQWo39u z>@Y?F6$4)J%av>G)WSt#K{P>q+V9vlX6;UBr={g3QM-){RYfbY_#SZ=s(vvIm%6(@Ebi8! zj42G^(Wcq+S9_A)2H36j5Ai9qGU5=*nIp;w337ji>}D7Bl?&60^cP+C&6%qv2~#VM zbg%s4`SGwc`9e0Wx4S6HxnoA3aWhDdSQ>escp`~MD0DuilF%+Dbk1crS0M`&fS5RE z=XKJA)JXVc6p|-M)A=5nryK+hVuuiO#|@{*Ed3Zu z9?6#5R?w0vud)9h7QiB?_A7%A& zW5jQ_IuwRQ0&~mQMiVC$s(LUDcv)Aq0B%qZP!NQqI|X-Fjy&HGLoTTgDRdj|xr*+~ z2RL8!_V#H5i)F7~m}KccUYl$pX+zVSjwI3^o60R&If{vpxW-A2Nk}1ituTdWD7B#O z4j*5*AT<N7uC$>OxZEnQS??Q=kA4~TV-8OJv-?;gwRkrq0yoZW;02bmE zY?H_KgvoaON9T2E}iFUi{q}-caw=Oe2&V@M8s{seS}n=&~@nOkJI?)tr7h; z!|ZgEKamFfb5ID@dD&qnGpNN9{wur(X3#{tQqwcbQ%9sv{r=)d9lc!XA=cX{S1W^= zso-}8%U^90{Yp_=UGY?2jIBPwubeT=IP{9=aZIy1#n_h~=#qo*)i`l<+ zmN)+xn?5jjaU#dZxljWY9{@X{V|5ncQH^W3SXh5_u7qCJ9WVaEjw|TeF8fKd&p{u6 z12bp>K5hrFUzO2oC0#p^h3*;ee*NdB0kQYH5RV$I5l#LP0x*hb89o#9wyorbtTER~ zi<*{Q`(t28ExNaz5?9}1-Wbf}EM1e`^yhrQoe*UDb`9sh@we)@{0ZN5nN7loI6d~J z+p4c@Et|x`e7i)%m%lWlVIMhpT&BL;!(3-ntM7Pp#v7wu@#xs~OFx8#mG$x1$T~a2 z^O?+UYaxnCRppahY0VzUrR~c{JF$6N0b=?6lR`U^tk)d~ZjaxYyQD6MS}cWfK7{D} zW$InYJuZSG+d6)LOE!8nis`Nc2X@{BcP~Z-pqk&6HJT?nwoA?xE59)@Y>nXu@g3zY z0WHi748-19b#B)>`tH7UqzA$~^_H>8gW6Ab?i^ALCCSy+^U(sdPejPO`mU)}3Ek*I5+&;NgCaNaoHI?g9g$kB{=CyqV38wyH%Y ztE9?Lna8KK33ciM?MF(wY6PBxKWyh@^&(RK7jthJ6i3vC3r2w88Xyc7Jh*#+-~@Mf zcXtU14uiWB++7CO;4-+o4eqWx$+zEDZPnhYyS2A&?fjbR>T~*ZpVM!jSDxqL>@+hH zV#qg`_|?O1mGs@+0Fmt%@d6AM?&hoo*vDfk!%lDk`OO(&a*2IVQR(sV3>Db8f*#() zK82*qD|I?yX3C7u%HsYwig>D+my*TXzTp6*1x&F*f^kM=HO8zwXq&xq_ey9>8n04K zyL2x;5T_-RNQA+#Cwm;k*tB$WJzlfF)v`I(`MX9|KL)XuNzFAK`hyqFHxv*YW#NH0 ze7ya>)(qPgZf>><=UG%guA%m=v_DKlPLqhV&B%94Zw$^r#~Exo0ntr z;7`c{;4R~lvcXol++#<}FDGcePiXaUv3PIRd0FZ=ke#@7#9ax$DtS&3``4Yd-D)zJlTBU51T!QrO-B5a(l6_BiUWEstSdRK|Uy zGLf>W$cEScsM^LcOA0R|+A{{0(yk?C3eKG<0c z<7LjCU&IboP>DLA2SHTHU+l`H|As>9aSShd5NFazR2Dp4@ei`osjNT#AjJJ8ehQaS z$c2!^gq~!zy;zc6341JHxjm5D2h~kaMGGD^?LXZg^pifa7(Kv~ZcF%tRJ%!Hjwxq2 z6`~K#U$i>HT8=*acZl{VCDth4V{SHn z2(iIJ!?6^S4{SR2LI0pd6*64g=FJL{(=%9O0oulOq<2tCoHD-9se^zfQeIJ)t;Ihi1KgSH+Qc8pNMywEW1` zt!=(Kb(1k~{W#mu{W|;NOBYST((u0SV)j%Z!7rDj7q{Z_f!uK#`;ng1n@+h@uw_>7@rbA1c;-4iF- zYR6oe=f(#|V_WMYtFlTf79NbdALv)UUte6*w0$dBT-a#Sz!~Ls95Q!G>s9GWs#!h6 zM9=2AT!at1&9$R0Ly@u{Qt6%oV9{PL{TWNWvmhm}KW;X*(k}9mp*f*9;Xo0!*y4O; zi&gZVBonzP{Y;mTEk`VG6XyG?ZJ54l$JM%~DF<^WwuHI;2p2nk*UL0`?=0?_$1IJO z*H|&Z$RHbm$NdK85BqeU*O@tL6WbdQfwKnzJ23L~^Td?JH-$l@Ih)C>yN7@VtiM1u zqn4Tk*5K-Ucc4EF>oz$MZ`zjvet|F~P)YNnFnUrN&adFf_&F;A{}%QS57{Lz_uT@z zuQdnmqR$m*db(*OXEJfrBW;I)$J23MAYXT_U;6g-ek8Q5$98(hIej)Ok2{fTwnMlq zMY`pMOVQ>ufzrqWhz_ga!m2kx0se+n=8U1n#yDmwcQUsh`&a zKh!)zUTgq~7%{&1x;xLx!DKJN;u?V8hbe$(5HXIDR3O#kf`A?E8Tg4}7hwF&8aNj#UCp$+X7*mBO!^zf?Lc4R zujz#Rjap7;7k7y`9dpp}>mz&rAaY;1-F~Tjxj7POh?iGc6?cRco>OMp8l$o+h}Do= z*j<_(9aL{)Gdghr5_wx#wc%xl>~uWGTK<~j%oiktTH0^l)b7$*3&k|byIyHiGSfcC zk7i)};sJsPXFtExH94?&C_29TQC@rE4&+{+&)%QIy%@{*GF3&&!ui$x6|j8Y8=`l4 zhxA%$ula?Ajomp6S3Apzgp$eFis*Gt9E~9rV}naebuq-4yY$EP#u^dzHr~+i;SqeV zG&mZ`#A1K?yK?sQMF{5PxpQ0tkkl}ved}JDBhdP!8CT%x80{=mm&s^KK+pHQ>&ZCua``-Gvj+8t zkTQ%@9mPl88jp7Ao~-I4(5uIJOrTH@A+wPq$J5D)pP+$5dY8TD9pn)F!X>_I z{$Vd|tz&Bytha2_-55YrGDcz zLNYTgJ_V<@4n**{X3)A7E-@@SHWq2Nu|hQ_mZ;EIvGz0-O!Tlon?+DqV#ftOPfWYOi+~HIYbr}HrF7aVI-vx zCWTY^5upC*8IJqv2FKodA(D~Vb#@$_@es5r{P=R)cZpWvbAh$ow8e_I(hrEqJM#vwN91$mjHxppg3RdGh-+%Z)z9LMey5Q|0TnSrp&Z z6cv%zMgSgj++5iZwr^>W=u4jiAayA6c%ki{Giv3>V_JRziA;Ai#9BS>k4WT@0H5>Y zDB6narBg2-7YgIN{3jQKQOVaeBhbpz__4sV8{rFWwY`FMeg(;vWyk%c z)e_*H=@mjlsNHy?-RjdN6hhPYI(A{wC2t>Ps^j+cG;N~CGN=;ro2h&`jlu^{LZ{h@> zi5Z2YkE2E(P+9AZ*fLo+Ue94^3*;#ah>~YA+LJ~AmNnAtTz+;8wDhNqR$|Ie-6lXx z_uU#sAS@@{kY3dQMj*uZ#NEFy``CLcck@UbQtp1%i#`2^z|2kHvR2>}p-#_@jgaA5 zK!8bnA`H@Q?QXm7Qt(BAbXr{D(XPe!o?12z){Q-~IiToOIe+)!z%-7vee`>I!V6tw zIqEMv8I2I`qW5kiU5(Pe>`uPyS1{hJxEK%!#!HVBJ>sBP(X8Eod@f%atylf!z+Tao zZ$>lKGVgjLOSVTF2N9o?kqry>8A{K@#z;f-9vzAHtBvsq#3y80lkPhsDkoMc}=A{YJk+P9W#U_0^&b(Y27v%C#zISZw~((xKw< zb-LH1Y>yTb3)a}Fi#Y-J;a0rTlf|m%c_cIOS;utLU?crVh_@44((_|J=g_k-3(VJP zWurg)Z z`!nCYbE5c>?z)cxOm|tzY%(~-AGG*BxWKu5uf9=-4YIqtvsZ~Z-~1|*q5Rw6+?bU# znYUhoKpV% z;oV8j%pWgto%xMOSVTh$3$x$znLW~x&G>`ublydn+43lO-`s5Djf{LCZqvJ8)@sj` z`61+5(U^M&qkFrbvY_BCPIYoOE4|vA4V{$=66mauNIBhWph%{Q@o_xLGS-?$W*vJo z4Z6KApOE818dy-c?_lZa7MfUY$$IX;avDh&4SmnZ&C`DG{#wvfYV4Hd?$cjmx_h-O zQi5v@?l%Dh$7R!%9%@h`ny@H{ubc<*IJ9{PlO%*Mjy>?G1Oi{~HZv|FP3wERK86+P zGyi%n$=#Z7c?6H@u+y8(6rgx7NA!ODvx6g+@UrB6}Zh ze6@om@N7Lz;oO%!IHl3ree9PmU(|e>JQgg{lki}P5>ph*>zzk50em)Z* z9+?KEvupyP5>qM4xhYk zv6SRquB?n=0hWrX7xk|7J#Ec5l(L>}Vq#;oKVi6kn_95(UE)6_K8zK1I(aaEEFjXh z*cvpvOD&gE-n38jxvYKFq^M15tGlUI@alW}M&COSsK(H-Atoy1*eD;+xwFp#NCjBk z9=$vbWb=K2*S@z8dVD*4;Cxu1FlW&aPgA^3g@f*W4=%Vc*`O$5~EI|d*(t@o2HC|mhrg{G%j#4Y_#14e;Ofu*q; zsKQzw7+@4(X{HwBemq2PRDU?tjN`Kt#w42dUfy>OZx8SrL^hjV_Pq(X9Q2yS9c%m{ z9GP2KtF)$}rYx{~5WZT4YE%n&*6%6Ne*Jk9xjD+%?q)b|;n!!x`1MA9%O6dk@w1aH zYK`0M@%_=vny;($vGJXiOJg|bxXgO0c|<-q+xpR}!{hc-LXW-U;;Vn1%9NpF#jC>@ z+fxu{wCpd7wT6sV8T`%n zC=zX_w`E@)Ag4t0RZN-00171bEZ%mXv{OqNerRZH__nq`Q;>ut>-CXOMM=jEcR3H@ z7#Ju{PF^sg*JvoVTL#j7Bx{}&;!2liTR2HSy|2Oi@d;7-4cT#n@3A{m+)VYgIOugF z02Y=VPH)71&u1>2Wo!2JGOI&pz>UE7e0Rx>P51)^l)}?LPQ%R&(tp|(*=hVZ$cN^{ z)yheg4z?Y*YIlndqSQiH9(&Ws!vuBNqB>Tn&A+I)lAec)A~|4}d4OA})~A`@bh;JU zpQDhFz{f6pykFO=b5y(Q$=Yhs4Zr@1JS{7x@)CoRb~INli@rFjJDerAG6V4A$k$2L=5dtnuCD;yqd2FLRpb}A8>6)M{7 zJLVR1EQV7WwYBe*RiaMgvPzZl-v`cebYV~$SfSf1>T1OmBp`R&UAfihr&rw}CvKD) z_0o@>o3fdEFc_3kZ=bN#sd5t%eO&(9cD;yNP8A?%hQRG-{(X|=$0NqI$Cf%hu2A7r zOliv$-Vv=EJ$#sbAG{Qz5vgAa`F5h#NY9$9-x$S;n9?cxEiE^ZNLY=@6Qv5cv*g;P z0jFazj5u0RbX8LJvf;qB_7oOC1=rL9r2P=67G$pAS+YERHZzFIw>cPSAdP9p32)Xl zx}cORxE6S7Ehfl*Xcam)TVWwAxYwf2GqUpQVF z#nEi-bZTzWV0AW=gZ!aObgIjkt*V0mYHVj`mY}+_TM5P(`Q%_N_9aW|a?wV|jCYzQ z{m1?W>^VzP!HIGu{zNwtX2ExxQ9Te|c?e~s^q84BntW8HW*7RHy=4-aaCK@5MJQ(J z=wjCzonoE!*b$pH+n5gX(rW8WM!m%Z(R!lSzDL((>w?{-jJ)gwY0%zP2Rjaj=_N~ZAm%4qP3Ak1z3{liw_3+ZC?R| z#yMZloUakXu?-H3k>}UeWQi5(!Cn(}vBg*8=@}oDHB7Lib8!4F-LU(E3UqY^--23KMDuqjOLoci67e&_=N>i@BSEudYwVeZHh>NS z+=|w2QEt|NL|s7eu*v7#2Ggt|ebJ-ok!A9dQHO;f^xn;%t7jVJ)HD`1hGLhfCSJIk z1qD01%~t%CZSoOFPhzKRq7_YCxyWnb^V)V%kr;gDZDU-RW)aC5T|EeAvoIW2En>nA zB!_#Zw3|wo`J~MLLCYDv*!lT4f_C}FeW~sRiW&+A4th`HlCijd#QUAjP&+5IwQ8ge z0c@;6%9-tS{E8A>JasOQfTfm@aoCjoy4_g2a9xF?Ee--po$21bSA+DEt5%DUWCjZsEJY^47@$72ZS zBu{92Z6gt8%a44C7lpTPLAI`7JkZNj!fw?N?mMXT(d|x*#z<`D$G}#Zu4{S5?{T+r zu?TcI!%<95NKU6m#6lmiu~=15$Zcyh#ciM;mF_*#w%UP|w-IQJd8VkHng-WOXd7^C zyrRQVROS{A;;>77UdOlLBT2`rMqp;pQ5ojW2#$x(tu-`MkOGP+wavxUMX&i3?RcX_ zO4rG2OU4CUrqxBXjJo0;=_h;Ip;G`18ww>I? zA-TM9GkOs}F@sI`TivZ(*mmFLl@~3r{M}Q=NSxN9R0$BRW;2NvGY&Z)+tt=}F&w7F z67t>OA4{)jV4xu>QM0I-aMdSCm7ub^R%xo{A}>hiU^nBs8`y>hBjC0ja#Qsbzi+5C zN|mtk&STdRqn1pbzH4zsQ+RA3_B>6cZ4c8U9S2KtMC!X}dAZBVE=GTtZrpk6cN}W7 zx-DBJfK-wG!a<8o2v#i%#n6go!@_!~+=yo8?!0O?;PrFVZ(vVj$zm*KrM;l$u1t+zsh;_KeyxK@G40lZ%yoZ9&G;5}@i3-M7TN-7+(cOVj*yhYHHitxe{gH_ z9dX3(2=~*Xccedj17{}*XT;pp4;DoNTOX~5qjgZbu;HQDECDNWMJ1LwV^Ma{jF0}> ze`5i&-USzZ6sFs~h%@zYw1Vrx%{etg3@oIa)D{k{_qCq60xlEw-=s%qww+JPE9`DB zoNC3|SKdeLaS&BhVCfyb7=3}${5?-SAoo3;iv39bmZe|g&_OGK%Cye5^vfYBIgqu` z46ivVyIk4EY44fdf;V;UD99JAUfIU`+)j)PE|vv%;G$A4I*| za`?5H`V+w)QGJ-aDCfdHLye1(UT4pS=!wN2H;Ykl=zvUx5UYKTO**sCp&S5?3VYALXui|c6A4@_JH;+7x#%eLRp^xjG_iY=(IbwDGZmp$o zQqo5Ub5)?h-t14pU}=^55+7MHZSRNHy!lAPgtszPF~PR#5(bmsTK-Vi?4E}Q4-cKi zY}DkH^^R@n;lE?htu(v4@RA&kR3b)x>Ls24Xo|#^F>#mNm(;=872ufd0#HiY^3A^Q zhxdjhdt%8}u+>an%C zCk#Xs>H&mZ>BUyDBp;DUt)AC-NSNiw(HmW2H!cH$)4~bGG>pHNwjn|k62FA99wd$j z^xc08kix9RgP>)84MYpQ|60-SwXs4_XXC*7(O+!Ce!gvnLJx0c<074%I#eg&dhzq| z`E7Crmqx8R$-od!e{`GK3}mUupUf<+U3eq{2w`EPoI8toXl>hdeS*F1Sg*%Fe0U#| zFFHq(LK$Te1Mzz7hQaVoIuB_t`~XTW&JDxzB=n8XKU>stf%fB>Ry%7RitWTr0>?TC zgiJI?$VdWv0trwcym{vr?hK_(!wVKp`BhD2=pVWavsY#52XUq>G@&^9Tj!;8K|lc2 z-cXi4I7|Y|eP+?N7CXr|83D6vo{G68qt8(W)ImIMv0pR}Xik@1?$*<!s zH>Y8r*y?Va#>>!+(w$olKyz#5umMSRZm|S2$aP}irAu%xXp~uU&U>khy13*L(l>df zO~Ya0g4O@rQKulMCADnE1k#>&L{xjHDuF6%a=ORHBvM{G{qjNiv^l{X>HW6mjx|`_ z$!x8^;DI0K!KKF%pTj?@r=eMen|ejnD9m(){OSK=?w!eyQ8HNrQCAYez4ArL-5PCVv)2e0^Qj+vEA=iz2`YsMHb%7;9 zZfE~;1cdv%c8=xjTa{xJ zoD&0}?NVs+1#cIIJ-$1_qbJBbOgqIW8bKiqMBN418cwx zs{4EQ_WLC}1dIq{)?(PJRG%g0p>dmGCRHgf6%dx)EpqcLDvMAT;)~Uykh(J*5IHT* zeIx8w9t>rMXfCX#bJW5?>!$^HSLr;%g)6!>_0V%m^(j#+5opQ4#q;Zn**R)}h_v6R!JsP6 zfGR4o?d1CHs$hcGam5Q~3Qu}I3KUv}_g2hU>wD_bY=_f1Pjfm$*Ox=1W7~?FUDLsC z$^PdtR9;9pKtoNll(x6USn$fPZhPl^C2Ja=@ucxQXl8w&6Q4yGr2U5jFPxH*#B^fi zMmN|FKmecZk|<#l`R1a^XFDy%rFYj*Wz84E}XH1uFn-WAZlRW8Q<|!n7-1 zv3!hPfN?+drVULieI4HK^&S7zBbRsCoPoM_;l<}(oUZ!X+<5*az%DJ6_vgpPH9-lN ze1jX)we9b*7>S>q*=Ah#e55eWbaL-6|9qj>Z#!eQ_bQ5d+eKhj-tV&Uem{-=`zAW; zL8B~C@K6@r%Yg^sBYaTDMDD1$keG*+*zb0$Mvdi{)0mzUUp2e4^)z|O1J`bA`%zG6xk;RENvVm^u!;$C!|LZ%kHjj&+p~T7cF*HwyM1py_NJ5 zW;`vlhqS2p1j6DZ`8CrXj@9v7k8C-%*IyzyC&a{FDx-|n5B;NTv?Vry{987ua6aY; zrk%4@Xp8Bdd_oGz{>^DlyQi5H2`rR{KX9Hv2hi?2Jx~Fowr6TR8=HHa$R;Cz zk>5#UH_(g@r}ZJp{vMW}j&r_-ob=b&Cn`fgJ=~$WR`)sObiP#?yi{gVy)}h_N-6k9 zez)E0nayyO!WsVn^BFogX}A*wFTGH1>dt+k)zyo*p6_CvG2Zfy+kguc@d>zyiuRR~ zj10S$yMabVr)AVubUFRb;wc(I`yEe6VbsH1rQHDBg3~!+$KAjVQ(BDj&@Ps8@yH_H zX6o3EXyZJan%V8lk9RlNsAe!q3>cg6tqtG!&pz_Xd~3k(A3}O>_o?EBipo9hHZfyv zsZB_9m1Xi4)_#kObrO_Ikv#o&IUsDnws6W)<&?G*uo%kmgMxfLgiSE-Lm}VmTr>?) zxbDaEo7rL%yzl4VXYHOdt~F%{v4hmPgNMn({cm`cgOjl5E@5F#4iptsXahibdC?J^ zHq*?+gCEgXU2lI!RV5+Tzdw{_84M-dR&W?Cu%%mKE>qii$GQ48y76mh8SX68xECh^ zeESz}J$>2=230L<39hYzyB7-kB`~qAOCe3oMS5YB3$M6G3uAAi)pPke3OfJvm9OXb zzCceJ>IfNGp%qUS9<}LeInGu9^F>7Fy2;ZoQ_c;L>GCN+Hlkz_C*gFR#N^>!%DK~W z(O>13;I zI{8;9=MjDaxx++RgbvQ6NFQbBJZdfi#B1_|2>@_Yc1!*M-l!2Um6cj*uW9fhSHs{n zaxhc`7E223sQ?&V1?jX_+%4_gDigvrQ?Pl5j2U(=<$QdSH;`YGaEP(SW1QSkiO{e! z#2eru#Gl>VO%9jJ#?Z-9&Cl|?$W}K2S`DN@#e6L?3oARuX2v^zQ1o1rW)^%(E~c5M zK(7_45rjGydoU!dsA}phgt;~dd@w%(Pkd?3VKTml-vKu4HGEp*^+QCalBg&lfM#G@ z4~Sk^ymJkSXpWeoIPSGo%q-f~5_4o6hQr{5E#>jST($*>E>bHYbDB?Q125c7+8jYB z)7CD9xJSpoFK6n*)rs|$A!+Zz$JRod11PKAo$^(;a%E9Gs9K`?M9LgSN7zYS~eV&@TUI_WG65b9z zi#{TBa<5I>OmA*ku+XUtTocOh@F1I3NXWV{#XK2Xd~!34bJU!LA zv3y=Qbl^evhnzAZapm-T>Ka4rhifpoZEmLMMAL2SOh&#Z_JGhBZl0Zl z=}Ss;h$luIev(5GjSf@|=DL_8c+>#(xsZB(Yqf5p0mH+QXXNCOt!B17A;NrP3 z`x9Iw23ed+uTeD`DIrNyoG60V<32BuKOb2_>^f%Gf`*N69lK!&4g$`Lv_m`BVmi_P zFhqYgIo{W~7Bld+oD7lM4dL{37M`U&JEDA=y=%9^Y+8QRi9-nXnKLhwr*`@2cgWdB z34(NEH1w}3rwr!{x5R$0Q0_F9hbY~+Zuk)pt@4`dHrp03aiB7CcgaKtdW5$N z1-5`z#-yXGWL9uWThtCwq;Sx6l+^$(1q!(0F^uP6zjY*`ovoKUz9u1)%r9)y8nP8a+mTYy~pAN=Z32S9>YJOS~cfQ^6O zx|Bz_RC{3Zin^VN8O0FnY$S6-fP1ktIkx1Pn=C^Vado@<5;jeD*0;(jWAog-mq?s>|(^g;H(tc-;A+?y0$pSDwoxZSS)Vr_zMp`zcE5z!)7ZULUnG8v}LOi}~@Nit#B8oIZa zldFPB#j8h==);9uJK0VjV3j zamw;4tS12x0cM8ztWL!>-5JS0E}s^(x0y6~N)N!6;&`)*E2{yHbKoc_mp-1pNXxm1 z&E;nNGVhiJsuyU2XBPs43)bXy>@j5AzYGIe5oCG`LNjkA;51FP1m55|67OS+DtZaz zso7gM7mqTV4~HqhDIESu-v~ukm)N`B4F{E6jnrh9+Vni`mTR0j7~DZit`?w#ZhE^t zGthqC>pCc?EwO9vOXHFXwrCih72@PsWWR5{>F?W<3y&7$QToY|v`Z`@c(?Zd#sbP+ z((IlnjUMjj{I|!kQ66Jjts%-Uf6Wy&8eg<_;WZm4 zBtA`T^-Ird%Ct0y{Nor^C-HTgq@97{>a&HkH~fsr{+E(tyk&D`sGTQlM)mjVCg%4e zVi?tCz>){^7bmXCe@m1;g-O15gqSu)NwYsw%|wN&OxdlF1o zJ(}G>^kK`4E;EjfT&HbzHF0*xKT+z~q^j7(lpON_8cX`6g5N|TauaE&GQSz$x+KwU zus_2aoYmXE-CHRgi%<-1D$T9Wd53%H{-OqFrxouXCbYVGf|~pJ@>6 z56XD&h6JtEI^z?;B43H`t|;PCdR@sl-)Xsysxs=&JN??h3{4s`V0DGWg{Bm^UbDN= zUX}{Old(vD>@j3Q2;!nMb^T;u&fsARq#Nap zkEU~J5&tP^+Rs3pbr}h1LH!|eX*nCqB0;r}|HKE@ORCLoA(u#MpP5W>=$c;+SC+>A zue2)xcU}KR-RpK{Fh=q_x7Ekw-eo0kcY)>{b7vkTnTDhJ_MpqH7fH*Xfg98u#)I^p zI^gxkzSwS9Zf-;?ai_B;+lw9k)EB%n_2FkW?$;vF({rFse6KsD`~Rb9JXE2$dAb$zjR&21a8 z+py;o=L9@Lk-LkrI*Yn@E7JdZRH`uNx=dxq)(g}*n$0^8AeZ_=W!X+sZV;x3ON*(p zqC$@gXBOhPB|5ts>kAk`^}`>t|MrjKzq6ilzGBvyw`Dkuw{CV7$HwY|ArQ|WcN_@s z*ON1ae$nWKq6($cf&Lo%U>3N|Y`0ywTHBpo+jKwVFiX7S{-Em&kWvZiJ=XxyCjTel z(TAvp@VCMGB4z+CO!%tC{_$kSv$k7eAEpWUXmZl0{0du6;jhq_618@E@>ku4fSl?MhDUBNfX?azO^`)SpkP?6qrty#}*H7kd!+o8=^nVBbS1Df%K;gwLv;p65{!Q~wtB;X9TxY+jnJ6~OYH<i9MA4 z4y>FUYj0ZjnIDPfpTcaT=|++N`+rAOefi17Ld;>d{{b4b{Uvf3c?f2#3iGt$#0qQ2 zjhz~W%|!;T2HGPtsWr_1-p^0kFI4T7f>K2-6`4+BRWvT}{>XzFyMeTSAMhLd(atWo ze*9Q?1EX1Luit~S>tby2*@cW--S}kk20Zlzy1#UD--auG^U4e(nj=7ujd}U&BGEXqeS!{6_L(A zU5tMp{r}(ObN>ex>iy`ThygSFw!_ls3Xh3VZQltY8(NThg+vlk zk9Vy-&oN)~ZkVY~)Z^wGAr0?TZSq|vbKSy0Ll#$jt!V%s`v=9M0S$s-yyo%5lF1q# zpj$lqCIw{M^sFeD(xsO(Vx{7n@C0lq&~f|Swsj=~-)aYgyNU7K4rM5UotckC3>@gK zVc2A1zLfeMJLp{5!euz{nv^S4qe;ULsd~W%q{-V-?=lL=wKF8s0tbJj+QAu8Zx2*D zE;T=Hs=`DbT;{fzAZO35sj$>#5h?R2DgT8gc*U=;{PSzYuX#QJV zN(NBMD&zT)bZ%J07)Fk!V^_uus&KVGl6Y9@BzQDn?bPCs-3{X)rKBXWnr@M5SSOY^ z*!Lc>>woegIFyoPXLPN$Eou5pT!tQtP@-drzD^OtDWo`KMLm|odR`1+bh0FbU`GEr z+j?g$@7HE}*W03D5nPEa_va{B(&A_gccvuKB_UWqkU9-P$PXA|v?#N~6IDDP>Tvz< zCPK5{w5UbOz8!C#)Nck-Y7hw4(NU{0{LY&mD&?To2V zGA|Wt<}dZKYCn1^=>uRMS6(b#ELj|4JmuCvH<1)TKxazFMo@URqy8aH)iPVi$SIN9 zol8(vMYUo6pAt>QPwL`yW*7(364PzwdQ}VQ=i-6Gqx};Ov|_1h!&t|}-Cf1k$-HGj zq+V>vKhv=bOR4oQk-SNwh0~hF;_pJ^{q>AO^OZe?W&IUxu1349IM_Ioi++-!fA=2j zUpg%HuNFDy{vIas{ZrP#qEk!IjxaQ1oN%ZYF1mjqZ#bP0Rw${nYAa);!>RHqPM0nm zWs4oZUXyc11D`5S($G0mL@Z(XNYe&nr%)`U3A3T)o=|}+(1q2D@D5_^*SithZs7_= zwbB8wO-+;SP@AUz*E;%boaWbR(akc` zny}$e(T(3ZC)zc&-edyJlADfkv`sge&8yH@u*yr4C7Y=uTCbvvm$$%txS;Wvg&; z!6)>`r=oM{^%Hq*b}O-xs?Tkp=;~UCJYbtSM266dxY41h9e*^SE4Lj$@I)0ZMLe$w zs2((kkjMS|-ug{Lzf_e|#E9y2IE1)uVuZHauy3EYywcmzg_(*7f}Y;`|7QKvZWz53 z_$XE!H`1!SVJDGJs*dbi;sh-E-s-4M3w)(qmeE2(x5toBw ztF4S5MVvw)Pn2k3b+gxsW*e{c!LT|_0=2xU<3W9pZYVOCfq!HW^IpAlEN8%)YfR@vF?W(iBr;o*U#oZ#YAqukt zCX)>sKBdt`A=#3)lnGsW4~Fv9p`M*#U^?{<`ybiMbG$?FQs|CwjJQxW*TG!9_l@Sh)fV=$;wGdk>_{g%UDM0+u!KUFJR=8r|H3o#=>*XorG ztkd+`kFTt{URp*r85Z-{X~qE}+lN1{Z#2talxFQgC2zn{WD4+_*L~lx=|TB2R;d-} zW4znN}JMcs5> zsGM|CC=B`FPBf91TWzz-VfuO-UOFT>vvK3Uu>gG9n@=C0k|XfWS*)Pqip@NSb$&BC z!)>3j<%iim%|a2Hk3sigwnU{EjKUeSY;}b$lr8RmOQDuNxNGFL`}X3otd$QJJ^HYvjiG7Ll~zcS zY0*Lc?IdBc|2mp~XZ_93^*3!=fB(D@g!$)5z4@Q3I{n|JmhtPq7m{GR77~)+iIXF1 zf{7r9XCa5dBzdDR^zhKCTe)=T;I)jCR0{$h3PCrh<^Om{;}J;q=pqBg)}c7kMr*FD zg>s${bLgIbX*!VAZ!l87s#{1%2pvjO8Qb2@U)Z)}a40eWg!&koZ0swkBy6aRVR=pr zUr7>okh-z*CRpdSJ@nu|Kq(|(0;Z#ysl4bH+LP0X z3_6LashP2{vGMVwn4y2K@Uu(5sIsy*e(2!+hnwtT&ijPgcK$!u1B~RXfWg$3?c0>% z?msXZ&g3#U-?7ft(^=ni1|-wzj(W&FddLaK6_oVZTfd&R5*5BufQA>X6y>Vez#H~2 z4|5%Jb8~55`tuY!gK ztlZ00;#$-mo@Nb+onv zVc`-tP_`CSdWfNtZ05P_dYU};-}{J9(9z~S^b(_d0Ils_D?X>$f>tao32h{n)0*5) zvrUE*q3b$X`2!k}c4JlNhCS3rN`ZcP`wSgOpQ4b|+Rr*|sxjnQ-@lP=nE#SGn?AeP zNGw1JAKUz@k;S_n{d(8Gco(9*m;`XYhi|CotJyDOuAu zhEiSy&E18(>732qy(y5?4p;vyeI`I@e)O{^ub?1B`XB9Uk99*{{^&O)eZ?NUiM3Gb zNa^q4f8W()z*ONm`6S!x7Lrz`fuf=!K0ZEl8zmj_@Zjl<9#YV0yc&@B`Qeed$&X8e zJlzI5ewqnI!0Ol?vEKXza$J1;{-h6!3x zx7%$O5fHA(jTI_lU#Rh>bGl0_nfjp|BSijxrCl&)@g-U3orEBqJLf`QI2MAy&M1+$ zOgMh<*%R;{8W9P-PhenL{jiYxqaVoQZKE;}m$CJ<-778@6UI;e z>RF%VdU}qt?fHfmI^#lJ8#M4{0aD_N30JFecf|WeWa-C6;N#!S=)65WV{QR!dz)io zZ+>FfQ|3|rAinD&8k>J`(;RCh?zKhOQn#Nt z>b@+WOoPGjMI?cN7d%J)*=awDtV3~@g3~w^7c%3PaDDvqHx8!b%y!^!o$0zy5L~$o-}A@{ zbib!-GY7r~5^;ZsOx~c7yZ!C%G@XF&4H++36-vH)RiA(nLh`s_B@W&c5bz~W`9&!z zvRfd~dfR(mBWYQ~tLI@ub-jMKBoHk#dDW#tMI!jCz2DF5+P}_Gbxoc#_Yo&U1D`Nb zb>wK(`^&|O9eIcPOg3i>X*<3h+;^=M5LhsvDjwS_P$6Yf!eSlazGkMAn53Psa~MgWtVQHR?Lxuk|227wJqYj9&RZE3$*>rbcDMX|urp4p2rILtab5m{Tq2)9c zS5W-qCPz+pA=`nBT+3xHSBh-$@k8Ucnu8<(4S-B!N0A!fdtuu%D_NGXkJfwJkQ&T% zXSk^y5k~||&VZ|kSyp`J(@?k7Rz6sgo{6=!^F7}&Zj4AxVAhYiToa0CLdn-1c$h)r;oO!poJf;Y~V1FCQzdsjH8( zNX{g)058d+0wA&$Wu*X0FFmkYGw$Se^5O_7ngTQr661wcTrrRY@KpaFti5GaTV2@x zNfju?t$6X`5;RC!q&Spfg%D_w;O^cQD_-0ZDDF@+I0cGZad!<6+$Bt&cmD5up0#E^ zo~*s@z0c0sa_)Vd-zB!u(Ns`u6izYEe zz3bTcp@Xa(eQS5$li`Cj3OG1LP)aI#GEb9k{-iIo3tk@4>1iFK^KrbgHd8X+DF)_N zZ*uW{;n~%4+`b%I$FYtpih?O}MIKjb#5Rh~PBwwfLmJ_mQ~z&?{0I+Us~!;o$4{ERL$1OpR2tiK+A3_F+9Tl!gI)s)e!k z8|;PoEI*VFo_zhhEkK|Q-TUa}`Y@i$;^+QRa=FaLN~#uB?Qw~~h%5NltEwrlTCY^9 zm}kDR^=tILNs)rA2~N?Y*A`LdY){|3LxlY`F9SVnY5-fJmAo^r-rZtIc;e&U7F^ti zV=Wl#c)e}cd#?gpH+PTB>80uI4J-8WpxEhr0as7T>tTr}c~#QO4}_fQ!5ihkDWDBE-;LVQf*&xrN_zQ(s zF~1{QO_ALGr@mb_dsaSY(rY=1pVD;qj$J0>t!(s>ccr%_o^!aN<+{rcF45e2xpl((yXw z$Wg#m^241|*dNE0V{pKAt*QHi3d6%q{FU*8d+Xsn5zqB$>j}s>r4+g2;BeFSkZK`) zg1q(M`ib1IFqW|3%P1qty6CSk3OESn>o(?hse)Yd_l30{g;c5dC?E1wUmArF?3}UZ&>u=QW{NAZsM`rWToG^Vdv*oCClO^ zrQL-1P;ci1DS)q6c;i@*3o;Eh^el2X5(?!TLF|m5u}b~0SgEQXLct+d0nG6v!IW*c zt{1;}$W%lmM*WL#6g5xJ@9=V{Mzp~1bY0!8gAPAYft2HDrLzFkPDQF~G;EU0TA#Fx z+*ibq<)WwL&z!bnbS?=p5Z4m{{vQ1x%M01IM(Nn7?|R0|{jNJ7uR=1Q|hF)5B| zy+jV6Rp=F#zxn<&LXCrCBJyQzfz8>{+{K{y=!6Y{tWVSIw^vN^XFtxkQ(R7CjXJz&6GYJBjMcrbG7kpdm7NyzeE@9y6bv{1S zFZxlEsb#!1H$F>#S0>z{ziPJaJFu4LxPGuF+*qPK4wkRl!Qr z%Sn7+BqD2ddVz6KG`;}IV@~GV#^pgzx z8iIGXi5%sN1s66Y*>iWR5&5HeU&bBMnnx8tw)$318 z251>$IP+?2K7y6AJfEUeu*dA63XX zpM?a?svqeu{UqYdzY_fp_mvOI!#{5zvU}{-mlgZQ4EC-KGQv#l_m{CC5rW>pAgpGb zu1m)EK*dx0{DRK8kTw%x(q zK38*;)i#Ib{YJSqYdEQ|44{MxttIG0SHz&w1=P-SEwXNBC0f)y!EHls+p6j;GRxr& z_hyh=DUQ+6>SXRMJlY{_0$Af0|EGV5zT5YmpcUz}b$eZVdHKg#ytgjJEOMZ-* z=ZD@=W!QCxjtIn*wYQVM#wS70lYl0SAx5Lb0O7vqNfFJzqa47t=ClW4X6b7nhU?CK zBzezX{(^-njJR8>5gktlf$OmE*~uumW_Og23%Q-AxDt>>b+2c!y$@l_?KuHk&!O7= z)2Ck>0NuCQb88=iKBeT&UbhA4A)ILKA2VdE;nTyngj0~?d0TVt?y%l>1)AV)g0ZzI zKh22?3Hw4?Ncp$j`6EEjd+HN|<=_WHU#FSgpA~QUvqCp*o2mT#EJu`dt_5~qawM^c z_!zx^Bt1rFxI+0Ri93vEc?x($OJ(di4zYYF?-btbah+IRt$a4k2Z6WKEL4Z>H2?LA zASqI~z^Xp@2nX)($;)OPBt-tgw?G(8OSoWUWNh_}&Wb5*zM;3F=iR)gh+-QWp+r

H}2Bg}OXSfO9W};}m*xq49iDJdl*K zC)@@f6iJ~57Q|+pY@h2Nv+P_H9Z5YLfVve7w~ODe%zsvZE_pLJx3o0PC665R9ZT&^ z>11Y$;Q7v;Ju6A3$Pd9UE)qBB9{~Ht^alNa?JJ7he}qzs`pCO?Ds1Lew0&TX70|y2 zQ!I>onIR78X<3X@_!6cZ7&>1Wl_)^p)?Ucy=cvt)?h}d^d-h* z)#%iG8Qu%i3;d?s&qsOKff=vv*j-h=b4AgmRv&D^+?b6On+`Rsp2YO^dZinsiSEb) z`P`5OcMg9)ncX$sqD6eIOaI~%qU~fK7`{EnG0OPHcl1VNnRh6Go+@D zjxw>inMMcP7sM$Wg}4;V(W%I_y37wJX4rr{@~2#@ANB(#iwvGjbo>b#Wq!fn*L>7r z9GmI^iWfi9o2w20(|K~QuAus^;#+>uwH!>h(a(Gi+FU??9!7OyhXtG+=XGX~4Bk&J zZ(V@YA%0FpTMKt%uy5~PIQWbFx%;k71R?qyQ9sUf@5ay`vC;(c|Gk<@Gs%K447af3 z=7&l5M6EQ9<=E-6qw;6rXimz}>1||ngZOL&C6B^#f8k|54wXgCTiKTjIksl>H0v5z zZ+~8|U>yeAWl?~8|BA|~iU3`rzf}7V#79U(82eo%Gcc41zkXLEBfyhpCFZgMa`1I6 z_S=8DS$eyF8G}9_P!4<&6B3`Ab3aJg_OR(<3_Fe5nwZEqHkJtQd{v%DWj!Kvd#gI4 zqbnow=^meCw*lf&_KrXSJ6 z2DMt%;MQ>ne=qvUJhgNT{jI|z(?^f7o_2ixsW-5w=ZHUtY_4%UJq5YaT^)Kqn8sK7 zZ(wb1THw8S@h`8l>-7AzG@z{_p7yFNAG3QQl%_Ord*Q!9X^7W9pz(YJa?<9*7SAE! zGt3(0ygyU9zfWaZ^=y{!X%Lb7>QHwslfqS$AEWj=^tPzwQ`!*+|9=_Ob~(g59nVKq zbKF9pj(r$&yjNX1XW+7TwS|6f%xnZa`n1OA*u~t9W33|bN0puwWZe{BfAhlXo|+I^ z>H|;Ltmxl=UdXQ(r;<88q=}Dd^qd~`#Y-UxH2g0AW2fz8UM@#Rr79m6@ehaoF;-;9 z`f+xN91-vCtVp+1042|j+QewJ>O;sIqkS>oq|I0Lck~WF+~ltT<2O-KVsE0#dzq_tKaAZ{dO1gjp*@`ykN1c{ebnk`jIPQ|8W? z_c4|#4uO>r$q%6=Dx|0ZgG#qJ09)T29jnS?+gTZUl$TXFdrt0K6q~?6H2>p!vp5#%$lxz zHP#Q3Gw+e`nESJ2heNtMNvzM`Es2ly2cQLAE^H_Z09D7|>(t8C!1$EutZD1>=)U`Q z4+Br%t-HUDAp!Y!DYLWs0D10>D$5#pi~Suiz>&!;EDkU3cpzC=Awy0;!e*+fx%vC6 zrC-ZWazhnZM>63ETX)^M1j_w3Qk=KHamyX2#4 zVi`ZvZn^Gw3fM^ zo0Z(JFl3I2O15ZzxWK5gcSc!AETl7a+j^CwH|4c<|&_QeAf32 z)L`Kj{lmU&@n!*g+cal^j*g8h+_2_&N{8w@V|BIybVDvXqpC&LpeQdl4DK<~Oh!yo zW&qc!J-005U{$~*|4F-6+>JQMFXAJi@#5K7X`>nuN91!;;br0N)D4;n3RAPqxpI zsL83q8mSB-BW-0iJ@DMj=3g3Xe_wkTV#~IKSyDjZz^+ge31O79Qcn8kTvuLZ^OtWP zAY=NGTwAbYOnTqSZ{@PmQq7VWrl9_^cQ5 zFv&S=4{Pqu7f-XjPYYR8EnRVTByU?5ynL6-CD**~0&CapXX ziABZn8S*qv3jRTe`ctfwl+Q0L#6C@ACq#)ycw4Kq7TH6{Gx>#X>q}8;bV!hw_p=u3 zp0*|57EbfwIrdBfyT$VgI%7Ta1vtBNli^(?{-s@{Oqqg*?-8;*h}~fXm(C)Cx1@Zs zcB8Lg`^QW6WnUK!rEW-s+#_tVEjvTV`AK=1d7OL*%BPI#vXnY?&{j=isce^+fTjAK z48Z^7&-Z8zzp$UwL$BuU+?AI6+EVy(ld{|%(iybFbQkY?Ub^>)&Lhwzif0jdo*agA z7a8&(pOY_PCAND5O@sw3rRpn@2w(`s6OyeTzAoE1T5{zrbWlo?KMibHs$>KdkIk${ zcXx=1Nd)x9O{voSWGsCjfddX~<3+i}83jZqa;+-F*Va_^dP!xPMqa_660hysbJ_jU)DJab}DtNm7cfS+7SmY0OnE zEw(RmL*62I%npT*HWT@w5>Q?lOunrWG-1gtD$1T+T{`@^An6-vrkL8=KbZJ9%0z*! zhvhHOI{o+~k*zdD&tUvBYll|6c_maOrwg#O%P&jS3w6EPI;c#g4NB<3d8ehz`gA3Y zRBka%s+K){C(H|1MpM~cTSG^w=jb$V$5m-~&WlPjmc#2AF0G(D`aA5?7a8?;?+Y7h zu?YvGhqz#wBvjPYsg;)U1lzuLJy#ZnqvBP~I#imja+Fsidr)SYJ~<{Ni7o{4wH&59Y8v2KP0k<(DHz7NZGN#axbJvDXX?S>qi(8+Pg z7yRE`fLA?}B4LyovHrXS+rM{6=h@O9Qok)(;DM!5bsYPQ&sWl9w+B3z%GDzlzW^Ny zRD$+b6@L5q>6%LLhUyQ&ts{DDglpXOQAxaRi1>E%m2Zo>rX}sRZVjbUz{Js^&FXH@ z^MlhA35m1%j;a5wJ!T}gc5>>^>`+q8R|^}K`IULIl7j5Su58ID;gYBpdskc>`=A6X zE9-H$S$Gn!U3D-8dF+&(iY@b%BemZRXym8S!W?(sM8zt*XO>T(uzMhF! znRDgV6fO(;pLSUn|9DShLz^sbfs79Z>lmo~ik7JuDjX#tE>aRWXq+0xWk`<|0tQmW zrjk0XQq6lUn|Lk~!~~2wu15S?+3rsL#9&0V^){SY#J1eZ=WfW^I zvB9wS3@ zHas^JVp(w?^wdh)6GP)mCMV3^W_e*8(ozbE-g^dp?PGIs?s}pjU=F(|SD8uq$82KC z;x|`qK{H6eC(7p5jacmUE>i!49+1Z+QOHKScH%^3(C>=Or8uX)on9b)oq4WrK-09K zG!7tvY@X9et-H!xY`?AOLDj%PK6MQ)M@K@^Hx!b?MwE`cv>IVvSntc^0jp6mM?foT-_6J z+$QS4MJm|p2R!4~vf3Jx8D%;hwU-O`e?ofa%9`Fcc~G%`L3R=jx}X;Cww5m1drGyb z2F(RO-H*h=KA55SZ|bi03$JIhYJJ?bsr)KtfoW;@%Z=Sv$+r1I&6 zd9+Z5D)sQWLn$&VJcS?Jw5w`rQ}G(=z4NBWh+f6TF9#?G1Zeit_=1QkdXS7MgXn(P z^ty}?#k}5{^ZZMLE9nol_x)(AGC>iRJ`(xqfZ2YE{>Yoyze0H{r3Tle5U^02gyZwCy=s+vu{2- znf^!pfdRtI-&jQQR@gyQ6}#_wKAskgv@~j{NO1?CMUCSo%ueOL!!j45-S<5Y+6gr~ zn(+xMdQ%)PIkA>K7)yWSl$Vr@dS|(B>?2Z7II>7j?tP zltyR3zbkqd)4*^=T{G7D0g2}s`_)$GQ!_#Pthn~FvgTefMwE#%Jc$@vkFEEKqP+g< z_Af}qeSC&?w_MhB77OKHM8O5v`vWpik@A8SS*xlIqsV=rUf4z-0BZg^qOr_q@<~A} zX6uOo7%I*C-~}n6u~qCBE~X1Q{u5@TW z1b%lXQ!db_KP!aM_a_DT@l(`WA!QZ*zKZMb-*xBD-R|yTgY9H9;U{@56NKBBuiB$h zTSP$7K6!O*s>tv1&x)FHM=~ON`CuRkm>ia7nLyKTevnC(K_FGUj;Cxk)(h6pKYm@; z%^D!uF7(5Aj;9o+hR*JxjVgLK!#2w`VcU{-pR*#PTW!jRtBo1%ZdB8k))@7_7v`4c zaapj2#+OfJi!O=HCf1$Ag2y|NtzG`6nLg+F_8uo25@LcZ3vAf7wKPV+uZVF^shGSWNdg z9`7Z|-!wnI*1BY^vQcMPax2u$^EmxmwV_{~G@MQ!T|P5^+4A;1)JQbbsQR{sf&p2{ z^pSETylxUMIY!l*>zJSL9)HzIpJ%Il>b-gJ)K-^x1SP_Dg_Ys9AznVTHn8g z&Z|~Uo{+k5YxDTNh;sj+*T*;dSvo!H2=RX&cx?)J6*1d}z8!^k%az^bZ=-;$c*xp1 z5z+C|r==4vWXC*`I-AOsSG}$Er3XgGV2l`Syz) zYJR6ITZ6o34W$YYcRoI$w#X2Mk#O?Y)s?lay80H{8!Em7Vf*KK>_8H|ZUTLv%i@wp zolwv=Pk^WY%SGRVe^Y*kz8kHV!-mVPuOU{{`oOHwvc;56@TI02E1}pSvjHC(2=o$HHug`bg7*k6*iw~(`$G|4XyZVrT z?LnD3=1D0WLxPyR`&`gl<3~pG*GUvYR?Td75x9@|wLjP)Qw4+n`PP+j@d(jU?d>fJ z^u>ul9&AL^&dbZ>Er6wF+WqHyNt-*8&gJ{jO?gFj+ni zq~S|zq*~$^G(<*u2GY%oFgt#+wJO#9rV?CnD9pTCIw@LuMp^TGrH|e^svcb~d}`i$ z@nrz2Xa?}*YbZQX(S|1EocwFJ18ea?U+QhAW`7laBE*icR_~3e) zU$IpGif|m{RQYGhyy~=C_pk82IB0JvYFruR?@ep25zjZ(@5aE>U zySGJh90H~Y_wi%kr)pA}HupFsI~Doh5DKY1U6vSK^YN>k_jTWv=+ZH3jnsu zz$m^cCPd5WPSWL`(@+!xzyX!E>hQPsuy;idB86eRUM9nA_GDJW6ZWQgGdLKZw5Uyd z%JCJeaDEDg0Yyc-^*yo+yEdqOZ$hURZN{ec(zxZ??>uoe=1o$M-7GO`;FTVJ?JU$#m-@T z)RIz9*aqrd6{Jy3v&X5C*}eJpJ6$|1gPfVT%Cgs74C0$T=k3H~sK2#lrn^q1W2v5& z5=c?;<30U)U$&{RyOE6dMd{9mI>a`t>cmqe8P8*8h%-eV@kx;&MqWXxIA@cy^LKDZ z34K~GKxAz{;XM^)o^A*w2jjLU4=ZU@glK%N_Q$1p_iETESkzm&?sTq9G0@;yn@;F70QB?*9_UpR0R1I;brn1nN zIn{?ZyWU2Rvjg+X$Sy&fRjw0zy)zw!c=1`MCeZN3+eF~}%i^W?AsQ;o8hUjXoMdnd z2}>ofxSKi`OD039#Q8SKK?Vf18D zmxJi>B&vY`r|BBUDuo<&Y~4So1M8V{9EH$u55Zu+3-^+-@xoVXG}R zynl5vUN-3CFtDbTrvmp|;vpPPp4q#wUvm4vrZ4XD;ZtQT1vb4+X$W27JanS|^uUi_ zs=35_AZcw}X>V%;Eb7S!NsH6)5DK9zzxNVU2{>Ds25W>ar&1n(6(bxNkz%#J!Q-kL zTM)!T`P(vMyZNdX8DDVuUyzgFA)}-dP+bHcji_I@bYfL*yQkEzTs`1b<5L=1JL}aq zlnH2TLda?~p_VcSKU2lnUpu!6Lf2KHzg89dO1py3C0geK>^mb}Boa%T=d0eQ;`LF6 zX5V*#J+eBQ$$}#{X~GlmZBol!-f-G~Q*XWmhH6^8v&#N(!x{v*I|vT%m^F$R6}Dsu*NQ7U z--tb-_m+DPom<$*SWJZM?`#O=UtG15Ql}?#t#}o-BZbuKYpNRy3)2dEGtx7c$44D& z3gal^#YK70hE7rKD*PWbAo87>5?nxW7hPzxzoiBP6O@{%GOxM0+DIO%%^(V;GJa5x~WXNz|pYIZo8Vw zAH}8$X{E3r{puH1G$+~~|H^5R~2Cii5<6pR+LL~KOryL2|GGjL5a zX}*VU8TN!_i&O+KmSEy`%!Wkv7B~gDPEIRmLtLHw{cm6yqzb~Fp{a{)S8}G@6p@&1~)6Zt&kf(8+?kj7vjo(_8z!mrcIWvKC z@#-g6xdTuJv8{DZXi$dkTJOY^vO1VDdY6x2_a9}z#qAmz)Uj=MbDj3?)+S=BRN577 zS4~#$P2BqH!>ls?&Tdh~L@;Ifh)VRYoFC13VHO@DyC^^ron%7I=o( z?pd2vqS)dPO)fmEhT;#}|0*lg>OV0p^kCrxsWdkjOeV_nynu)SKu$a2z7yf~gKX7! z2tqEy5Ctd1^R!@9kz+m_Q8qr&Fl(kSr74n&b2fOi!-d2D^leUdmuIhst;kv({g!sB zS4KX0ZI=~9D05=+Nh2L3`8@1f$Qv1v7yd}toA2+L={m;;jYF`EHqY5Ov zyX))P*PX?1**c9s=HOZI7)q5qkgxXz_E?8Nai4=$Z)iw-b5chV^{nZ3)({<|lexRu z^fN*_Q6yF-Vlg`>E5W~9UQJZSBc|otyjHJ0X(4X-sORa^GYc7PiFG1%@E-HDtqb}h zmIU=zwjyc)#_456>g4GRJZ8m>yayGy8Hybu!nAgKyXQ=KB!sW?GVr4^x_67kCY|Xm zC{;`og+Q`@OS&Rt`Mp$&>$j?|*Eo=Ps^R((&v-YHl=$fR;@md-M=pXlgSuV4*YZe4z) zLA>#S5PW-#>5n4pZm6$Nq{1Fj(8r`>HW%6}FJR`G9b{RiE8@1wYFY77iBd)0cK0gN zpmz$-ZnJVtKHs@4r@DNxRtyNsLefeP{`n;au69a{C@wT;A&$aJVbm>0lw}uurZqjUCA~h7lq_1)2}%GllT8 z;QU{ev$<-^HZF{YrCTGPP9Kau6-hLrq&8QcZE|jzhb>F^WeZmX$aZd3#dg}$2+<|a zo4Ai(mwuD{;UhxY8KX;o%|(jbZM*%z z_n*R`WCAW$<+~-Fhj;$T5(~?zU2-CbhT8VQ%+~hI)DV{$ZhBqM!Zs_U@1xAWS{I_k zF0ZWxuWijl=OI5-7y?QKsHZG8#4VuKHAi@;AcV%j7x*gz7d;2P&2o_T0k!A*pWApX zlop{k+v+zIvFd{QVhL*~aT-y{%Z|T%FJB3_IZ~7ZTHJ4#SyY?oFZY6@1tV|+-aQZa zbEKG5ISlI7nWQqwolpgfs)#_p#3l^(&hs-9Hh6>^=?fAs(7J0uSJH!AfXX^ zLf#RfHvqQh0W(F8-7iqaHgQ~AIRv|?J<(l{jgINgNwA*pzv(h07*EhYsg3o0v)VTh zOiv<4e%g_sYY-m4E9s;Q=%?xXEI?&MSxcFxb_T0Hr36g{mJfE`ds|sqjo}m%5?70i z{zR0ts8huPZI&$!d&FD*8P}M_T@2qr@8QYw_|7dk%JLt)w6BK8R0*wg;r8j`T-A>2v=if+vgh(^ zl$Nwb3FcN@cKG#at`vb=|K{!(1S{}+<}8h!&%I#;$vw-Zyx0fl(0_NKk*3kXlIq}x zPht>yBc#$pjCC@d74{v)uk?3p8fA9ugeO*m)%mEJ~<2i4(3Fb$xT}UK3EN9$kAsq1iN_g|#sJ9TGY+b4U)p z=^vlvcK00Iou3*>erX^)%?kG)c%g^W2dF*2;qKef!Ea;<=FA|UUW-nj>O=Y;+Cdfa>$4O;G1qqz)dy^nnhWZ4mjw=I<1gz4da0M^Hyi z-kw7y70}Gme+fmn*)Ry)MDuz0Lj;-KAN8?yj#KcN=>^$a9R)geSW5g2f0;L>w-PAIT!c^I}t$Q2Lh;f?n#Q zz&-(2S{i8@^>=c506UkLdh_ZY)S7v&&^Cv41Xdvi$=#(k(sG@J(?j3HztvWL{Ynye z68iFc_m(DZr~0#ZhFC6QQlzhJ!dLk1M0Md}np47_cB#!@0*PHk;?-Y^+OyYvRpQww zjMxyi;=Huv#H|za+8WeHj?MudVVpQ5wV4WT*E!z(qpJC4rg20vzBViMJjTpB`&Y?x zWsB*Ql_tasaNSv*+T~IjJI#cAZ&Ds-Zyl*}Gl#3kq~1i6DYV=9x(Zo&;8L(x#O`Ln zwR^w(e1VE`9(>~F_MoE;g_LZ?RqWtuq#^k0w)bM(>5IoxA=->tIki0^zHcaaGlFd# zLr#a1=>;$V4B+YJR0Xvw)F(L~Ivt7)?zG@hrFP{cgs0a*I|DDvVXO@pW3c$4AG=a6 zjrf!)wsf`Z+N~}w$SkE)nft6Y0C0H$B2`uf7tyQ8Pc-;!*iWM1gxvVE%0};bp0>vt z1x6%&9Fpk~rZ=0qyy|A@0^}dh6_0!901J=7zBAHRU3t|EQU% zkzBs@FN+#(vm=wibG`dl96p2+v>B%5)J<#96lC*L9Kb;T?ctw-xf7zicZX{r^}*@$ z3+^}E!cx`6jZ0EzD4I)&?|X1bCEHRK80w&~0`)tpHT)3>HvQB??;JVqrdTPaM=b5i zrS!X#6lyjS>uHc)(~{gG`?tv;rt8;X$D+HcRn1?IJ%R76ID|d1U3(ry*c^z=Oi#tYYF^2ONR?+hgHy3C7*zTwi}Z(FB^Q}UXSdOnk% zK+M`847hnKdgj~W=)t#r`%cyS zIoRWF0-1v{Gw^Oc)KU)VVaX4lbsVU%c}H|1vjR!8_4Eq`p>FW2>m2T{F2R0!Huj%H z0;x@I&i5k0h=98_^*El`-i~`Ig9R#^>BhFD%h8D2#)U!0N)|h0{~LiuA=|#Yd3)T4 z8_c^h2%WaeV-ilzF>Ra~uHqVanNjblD^@M1GuBqS%FfqzdGQZ5f7zafY9f3?zStH-J%%V(7%Jt zsDr4=N1^KkkltpnLmp}YeSElF&6L5fEa0*ToIRq(FDGVGv&fu1UgO2)gKjlO>1!(q zALY|~oG00O<&5ef*ICMpLe~Xpo~3mCZW@}MCuqAkTSbHZR?|02J&)p$bZI{?yRBNq<^iwR!1!=$g4 zrn`A1cqFY2mO|W4eJMEz?NhP0w)>>-PBtkUR#&rDB^d)&q&|lggn>QKXr+gFM2Pn- z?~;$`KMy(g%9?K7!TxoJ`8#J*PqE~i9{Ls>BFwrF<>;CO=PcOVo>P~Y{@+{xZ^kC@ zgT&Qe!I-W>J4uL97Q@a7t@CiIg3s1UYZ7h-93^a(K4)5`$D>xKZzn~d65wE3n9UCW zCIB0qku=JQSAVqlmx8#5bfjFi_>8Qp4R}NpVghLe*e9J>EzqT1RzcHaljG}0sEtK7 z*gGj?YKiWer^6u3{QyBD_#~bDcWf zqeebkz*Nh^{D&`?$>w&Hbk1l4h0h=H1+os?**6FE9XxavO6rDno7sTMUS_6CIq<+8 zFFr-Kibk(=4Wi^TGV??(X8^fnHVFTXxJ@;@2Oq#sA~55D_onJ!gxxYPi`0_rYY+D;n>O zaj<^8uQ|-|xaoy;T!R)GBCrfyE&oqxmj8i;F$spoRZk#2+dK~xcf*y3LlhY9n@$b& z>~R>p4k#a*_99C-yF)?VyM!A4Vs}mzkY|{x_|vyGQUJi7MrU&-?Db8|FQ1oE<8h;f z3LMv(NBJ=8G+1i-lIlT#spS zJpxQ6j>KVwn~^m5^~gkUTO+qZzZb~YeBQq5#>Kdvo89$jG6d9;)o}X!G#Ae){CiYp z8)nzf;CovpYGenwx>h!|)(MPm4^KaA5bLE4-CsFxu`1>mbWsYl!|dd#=fzx)sRW~jZ^obcSv&<(Yni_dqD)|+RN zOUwZzSF|-a#)Xut4umJ}QfA)CTd1q+?((^0`@{_k83@MQp?xX{M;oh#rtNwANaB8< zmK%=XyC2NTI_o8@4XR-R*Z&Yq=%?CS9N!7=VHdgUj35jU4aNL1X%1*h%N}ECfHd6; zv0+}vl|QQ(G{R#nej92Unv!BnG6Vl|>OXuO5%K?d*uQVQ#9Y3W`w9C`P5c8V?ti#= z#P6K{!_d8EQv4t4oZQpC|A;VOe+-&AC#jySlTw)pk*(rl{n;mCiX^h=E{OLv855Mw z)F>Dy#`-$TDEEqS_@_R9PT%Y?QD1cZ!V_Ff6C?~Xo=S{~N)MebYg`{1@R3 z2S?@nd>?m8-^RY&58AVuCdv9>F|0v~>B{=cPxDuec8Vd5yXQE zimN#8U&(#`y*~36gZdaGh!G`wRTHDZUcZxTJ~w9|OpPHt4cbFr7DBuiOEUKJ*2u{ZzfZclega5 zKS_N?rED&eDz5A%&7<>zG(oQJ%fLA3A^IDp;=+LI%77kYdlfdV^*8lmok5Uo&Y}-* zmb@&cZ_a6Ou>M5OHMm&#`Qi6CnNbWLN5@pZc(d#~ zVH8L+5Qt^IiyO&ftRsOMy0H5*k9LT|{a>F_b6<5=*B=p(&z^ggruG#cE7#i(6H7}= z%gY*ASkfUnCAw0#`_-VU_RF;N%Xoc2=VBU*+m^PVik4VLChi+$_by?Op}v--P~oYX zYlc#`=4w9z>u1u3AP+B+dwToN{LR}r2barNOJO1aUTGl7?oe;9qJ@-m!`*5q!`|+0 zv>X#19UVa^GZ79E)>ok&*G3ElW^K(RQMuMqbM^l6;dH+?H7fmj!}ev~7=UtX0ho8p7u6>#4sSb$I>{^xfiy>82=6QMM ztgIq|kC;s!z2=e59IJ;!*5>gCQg&q@=t!=6wz& zci7vfSk)}|Z-wwNr7n7z+bDpc$z zla2j@F@b8(Xmp-Ra{uPZ!9n>cnJlKp*?8#dv8_FtPJ*zAsA@SeD;wVNdbKr&+#F4||FB!v?8wYSvX7TXW(TO_;{WoPW zvLz)XWVF3}OpG;H?D}~0Y*5)5%Kyson*vsfluS^=3M-oU2i9lZ|EsgFjB4|3(&yI} zEl`RUFYfNz7AI(NclY8hEm8`>3GNy!h2UCBvEc6RuEAx~-T%8E_QU@7yq|JT^4uqR zp3K}c*Id^)UH7%6st=+Xi8btv5#J`)aNnl!X)aY;mW~7v*QL4U{j5Tvu zgnR;~AX!LEjKx<5B+fMW0i^kQ+3!bGiVg3al)prtX~f3vM(lHY-kKq`6K;2yK6+1mm38uPfbc7?CHRz_ zg_L(`N?ed0qhZTz4X22;MQ$P~kifzM2TAbti!t6opwkeU;qbP;b4++wn}`>;5l1iQ z;w~fUyYu?mO&wN@tQe$Uy2owT0~Rqj&&B+FM}BKz9a05c0P1Rk`iF&U|1&qflpWaK zTK3Du-JhfWCsv%JFHCUJq$W585}+O#5ZgzWk<~mc*E>NTPe#Uv@=?2f1{JIJGwl{^ zN++R*9Y{(aS}+=$t{IhE=#2mzD6ss5X!S%A+pBH-yw?(RD!GA`gN{W(env*sKlu|w z`@6d|hm5PI?|ZeGz()epyVELT!*T|s^ zu4k4L9dExl63FnqZ^Khau4>!AYer5BJqX-;6WdPoUdrr#(9o-DS^<5g<6_R($;&M? z^@GQb0RR3y14gFF!(>DIPp;VZ)8Zd5l_tm-T1oT!VDl~mJJSd$elcKb>A-Biip9?> zgO>vMr?2|$`s%RA4Ls>1{?h&G&T&9J4MCvAwtZ0J(aucFl2B97eLzD{L#GPTHqonm z+tio+X&UrO*)+SK)xf9D2`U$%!Kxh-Dwt6h=P-fA&+R?M;uMr6blXn{Gt&?78=Bgz z&P5!`+1m)~21+0~N*^d-2+ zK>=8>JWXM}QUCPu;k8$lI9IEHsk6hG7G!|t(T`O9pEE@v(EL`jqNzk#Ls>V4k5)x# zSy`F)dgKR;i2+bDzW^m}dbc>dyJdR0R=Oz8UN!024J{PN>aKB z*gFF&%}044o3S0rpzRQ0;G&v6*8{kVoTerpuHR7&pHJ`hA!+&2H&L#I>LEj z-M@O%^MRmU%zP>7Xk$=Qv{7!_{QpET!XQh?sXGcRvhwqXU)tbV-lk;KK(l2tsRRX;X zG%sHR4SoBn4%Eu{A-@K^}273oAA0?UIvLzacCEIoeAbg&}pNlRwP-&R`KJU~=pErhxKs0%c&SEHe~Z0uzizmyRI0o1jnCnqKEE977tJtofWXdUM5yp$eYPS~)tboH#f! z!T3I!MZSAFd97t;8-A3&FaJ4VvK6ySH zWAh2;Yp60_JRLlvlk}r}DuIYCIkr5feORv6abm9~wqSc?&?Y+xyluJe?z>5a9<7j4 zy3y-D?DY;eZ8MDdq7WgoDFy5_-OP4ch`>4exdIm6*XU+1+qV1c{_jAupWziDs`z2ZI+;7$>kv&$K8WX z-Oo5;@C<%b$vMSOP7dfUOCDp)(5|&uIDRZxJFR}a=N@m5k*N*3zAy}Tt^&7h9E(UE zT*%d0-mm!UBZ4-Uan~D2kQkX}h9gL{Yu!Vivay?fq}&jy)7G-}2XOa%b#fhey%pGG zl$8XzJw!Hkt3e~|c}s1;i`YA8d!T%Y_*t#nPUm}&c$N z2vrW*a65PZ&BZ2SauORowE9A<4LppRHRiqEs9yGSIwf7bXbA4H4Sgfq>x;*~JRVH0D;rH4lbqOpb6bxZUOZ5Z+9tsSG*Ky6y&YvAcIXQRT+Tp&u zg1ljMy^BgC0+%J}P^Y)eya6pnvuol-zLfA+H-I9K}Bbf*j_jNzfCf!CrWRK8{+ z4N9j)X&H75p1GIb*Y)Oja0rz5e;*}xq1TJo_VUr($jOK)AyYFv<0Bo+f;7Dmy%q(t z4@RTTXDpKSmo-0~=PQl}m~Hvg2?T_@D?}YcyFcsNV|g9>!RdBp5l5gZ+sia6P%9-e z=4PPD2HYg%B5#@E?O}r>Dc-F@1`aNaCX;)%k)c4hBQY_fj+Ld!K1^&@gT~xqtL}10 zd-k?M=$j|F$34)iWW4H$eB|V+UpvQN+0eE3@54_HDL#-c9TW1+hnIvj3gim( zM_Ao{MjGGCL0WMAUA=xk=}CLjj885XUzwUIYlU80tGLQ1Wyj!Y9exK!(NnXNGavV{ z`DZrqXn@EU@8LydeOpWK#)Zd`H_zk(+aJo<-i$yi z5bp8plm7(UiZRWHo0228HJc+Q6)@Iz&WhJVYtisb7VXbTD!?%y_RO|B|2`rqx0RL07r&!cF zK5@P~@(S{8=X+_uoA$cQxw-DH7@EV_a?N1bTe62-{(NR#!n=!hR^`4yxOP%ew40xC z9I!c9$5bH@1dq>PpitEM*cwPmQknFbU_3f5lbYaev8F~k$d9SzEbEv~!DBjMEHAH( zk{=uOfg-|Ol!s>G?Sb!Fc}fT8*=p@T_uV4f@Tdoh(sG^gbNs`^`8nLfZR?eGFw>{^ z!W?5jAq7EC`T}!n<8yzRX#M8*_oMm{%r|7DLG_3GO7`vkGk1^`ZT};WtB>ae^-tgm z{X}bB2YE{?s+}sLK$nw_M|zLnYK?mW&rg*MB!}W_d)+=LK7DhS4_;44@n9ni?!~Fo zOVZ)pKjj*%(*xFaLrACSKN6zFsy7oA*TYW;pDs)6wLBKwJOwVnQ)?L=oSbBKC;R>1 z-E{rDZe!go2788h&B;fecdoPNrzpo~`5l-TS_1DI5Qh$tQi%{%ue1*7hySVx_q)?U z?lBz8^>dR5`suU?E`A3sLIB*K*@*`xXPs`6JVQQLPFY2VpBRarPZ+n|b#@xPKuQ#H zF@dB)T7$||88tLD1&XBqt1>2{5@L&*A055faH87?kFpmV32V+?S%T!Y9q>~qGt>1N zH0O@2yEGiS;>3^<%*d42qqm@8fC1XGP$SanA;HU)Hb@-vduKUwJuNk^l=lH>w zceo~~v3Ht=M+{FV?mg`)IT^{Nm`fAvy~?3T^fy4To3QVsuBN8^_6t+>NE=pOnA5Dr zyLrfQz}ZP4(0zi&t8JmC{GRCk04;|lK7p2aH9-P{A<4lW+Ph)9LX5PU5Q=~;>-*D# zItH@Fa02E5|3mmrPWv@TAm}kSE)D%6=oWO)bnSb;ypa4|#*+5Skr`Nt;}-5l+0*pu zpI|rdhqGsTx6o34kGb)|uXJ@?%FYgHw?A@%n0glvKFsT;&~|etXKP6%^y8HPsCiyC zzDGa-9Bo(7;e5vI*@5arxh(lo-lvhsTP4HzX+mpOGG+RHSC323xZ?9@-&J@Q0&5;s zHhB8q4j9ihI0rHEDoV-Ea++R*0`d8izxQ|?xYE_Sj~xlwQ{Fo$e|o;sCdu*hb%|G0 zwzN3yx3Cr^RKi7)!$Tm=?})aqQY(3w9>;SR1zl9V#!u&A_f;Ud((pEA{`BoS>wnk{ zv9L}sf?kam$5~@y#yqUYJ968~wC`nkU56Ukq5*_(H_@{?Dc=D_$s=X^Su-(^ID@Eg zl#<^iLZfdO(G|r9b9Qitjvo0ew;dsT3|~$$ka&PV`k-@>5n`UOz`+#i0_}dVF=nqs z-yo6+XefjXAp?jxnJ{(D8%txZI&VO1Q|CCw6yVcVZrIhQ@=R9>nrXFa67ouOX>FK1_WkM!#OK_vkXBjqkMRaoHwjtUb#wb^Kj$3mu9>fCEYoWe z>4J1>)dDU0hB9|?;;b@$un$aFey(0M8ClB?c4<^#BC28>js(*3@NCg;I*`Nk9E@^j z`s8^x_l{g&={z0I3~+7rv{e;0olef-YUarc?-CEQX}m>BJ+WX8z(%JKk|EmOouaT3 z6q>g8nOkSIN>a0c;eCrZTn=r|<^7<|QXU82>q<72Yqx|V;+<=Yzx~UnPlC*vF zOYvx>t{U(D!|rS;!kNrBBR16P3}n9K6%1FIJ0xfkOykGLTrKB?s`6X=fNf_@z2X-! zGE6sZB4{#mr;zy+G@K&ZQa-tf|9YTa-&9OcH(}G1j;W<2U)PkDj#AjTl58(*H<8by zb=l3e*043Ir;WNQ`N8ZS1>z_a%R)8$GKG7P5Bqwvy!2VSP?*W2mY1a|*y zWGXl=)NZ23s9T(Q;{5FLT|2#E;M^@-_+?`KE4kp5R+q zMf1;K#elQ>k0Y;%6^atg+?5vGVa59NUFAXv!-0v}7!#i&K9dBks zOIPoogwQB1#Ru^l(DTd12CYTR)23`c()_}HIfrO3=lY6lo;Jn!cwJg zr01}WDvU}jMIY=V*J?g&5${bj`Ewll;n{> zN*mWPM%mEzkTcXT$KF+R>Kv?0eN*K;Mdkx{DBQ{cj(|K4HK3&1}JY>0q9dtUJ z?RfVyGJ&@hY6Ge}QG@+Aqoa&tOpiO#pB(JcBy<6_2K)2YEB548r~=^|W(Ig~kZrBQ@ia%lbC>=&7_I5Fg3PFq~Bu5^p^|#n;qp z-9H3-%2V$>DtUoTH-fN#2#Xu-Z4nCHeki(4b70JF8%-kLmkdPV zd=n`k6eYX($yGOd%)egxzh?@r_&6|rVgyUDDTNaEkmiB5?R;q@xqOrZ>oWo5<2@0N z(UT67_syt6VPm=L-wfBFFF!vwbxtSOTCI`)6uKv)uuZTszYZL-+ax+#JPn{ zp@g-N!erU6D^!#i3ye|gA#3_GqAEnM9+N~#YRWReHaHS z>WnDael#nEK$mJuYh5h~hoohRJ6g)KOi}NfYkm;UXcC^G^OF&izln6n-T7IuTXUYA zY;J8|e_7O%mc^gR{&o-kr(6L0SDga|$^YqCg!hT#(BBR}4Fa5KalnMt;z=@yQF zu(S2p`6nl+bv5+#po$=2edyG3nwBd)0wkB}3!jgwvU{hAB> zkAI8ro}Gvk$L8Y;L{R%TnZtka9slCkPZD^T%X2*k%A|Fnw>^b-=cLm{Rv*noq)P>m z-X;=N=y(C8d5Sm~i>i&FPSPQn{%V`Z$@UOvc3pgJ;M6={oe{%sLGJ{hPv|!FH{>;p!^-6b!LE z+P6%YUZT7clDL_53DT#=RoD^#Lxfkvl{}rioi>RfkKmfFJl$*Suwrnh@|EmaTqE?2 z?cK4_okL*YD#)NGfBQyEF=4_%ie_@k-c(w`ADdqji>{+@ahJJ2r`kK0>89>Ju5N9A z;@6DfPck|K7Xd~(vz*~l7Um-`1>S=kR($YZZzka>eb(dzN#Hmnox{7tjm zP(V4y?(@%TKKCa9y3m=stuD&8F=D{;(Ccc4iyw!QKuY+~W`;-rDoT939mYOP0Rx)M zy%t4Cv4666Q@Sv6zHu+Q_pti7^bOqh$@K4+4-Q{11b`uSR-bG&4f8(H(Q)<6OikC! zkgxT64c8ISZ}-_ta5*__H6`b?x2k$NtSBfQ&)z^2@DO);v~;_S84%lJEW7}{-ij4v zO?xYWWl$|M|1{6UvRUw?Y;7T^EY5Uhs^TT9abuX;lk$B$HO0^flv17qSXcZtv$8lp zCLk=b^2_ayo#_WIeVCSxqA)V$+xlDxw8`2gTs(`ID*sm?cwl$e$mn_E!J$CDO?G{YBQw$-(YV=ar|O zhUL5aB*NB0JM`@k+mn6ugggx^Jj6hP&nvgX*P%!Yqo?&|**2fov=a@KMPR?I!&SO&}8r zxghNv6a>qNlqxUrA6$iL{f;?3468n;~~F7}t3w;D%K9<-Me z@d~M@SI(_xln6Sk?$yOd;g-A0RRqlyoTg!5ur;xg|>;z3l@Lhj@jJqe|z#D?% z=S;lx?V=N}Upl!a#Uv7hK_ekhHB0M8R6G{ixDrV zKz%j5dTxPvLbKCdxPoDd&f|aDD6}lOnf#Tt4v9Nk|L|msu~EF>d5zFL1gEObA^M~f zEG&(;e!$6)6KFlgmM9XAumKj8y2O7f*B<5K-#zv`yyi5w#0SCl6H?1#x%J$ci7EF^ zju%fbWO_lMvgm;dX=IY3=%0Z(<&_g+I2%l9J!W<6d^R>$qZ50A`0pU}07u5MpQ)~40HCyJ_VKinaVo=3#gx1NlcU7* zYO`fo$ny7T2bd;~=}-h&7Q0nNHOvOg$h%pFk1JtDHIqHhvSKOUVkhuGpw2aIeJK(AlXo-Z5n?Mt&f%7 zkZ>n3D2FDOv*=2vQlbYMsB#@xV(o3_#}r8)WEtOIfqS);J7N0a=?hL1f5*5U<6w$Q zbnnsP$`NT0IUtXPrCzTVJi@elAU3;45Q;1x`);8n+>c!@p~!W#KEQs?SHe&eq-r_@%rcqCyS`>lufxg;1a74 zvkY}kzrKRV+bD&w&o0(qODbDJ=gKPM*R;HJtaPmSXq%6meQD6sn6+7=E)0GxFVc!s zjwqMqt$&&kx3-a*J@p@O&7fO6d?&X9jgdytEt4yc!{|=~loUlufhS<1m?fjOyKjv* zCqav)4M*g2woB=1j&@L@G@phRXofZcK{^BfeT9@a0s+a&fP`gZ)8w)FAIr^R9ucGc(~*kGLlwY~yCk;e z{mW1osorY1bgGg#R*D`RJ1oo`9DniPM;BU{waQ`ZL>9?B{s*+-12E?W&l%;_ImAVB zy*195AfHJc#Iq(irD;Fbat@7@Hdq?YPA%&z#PxKo`-!$=@7Wl3EqLfbamtDDO`e0s z709L1>FMQpC1s}Aw{&>flN|nH%fKdCVgTW3yO|fVvD0a+1Fx}!iyR(i#I}>kpQ|@E z91gvCka}IDs0-*q)tSSd8cl9$je`JGaklo_hMImbg}X2mT5jv~VaB4WkDXV*YrE=B z@#4}yrTb{ec(v3~W~i|{SYPN@t%v5%_P&pFr7KEQ%gL4T?cb`pxwP)>_}9UD8qYM( z$cQ#! zBFE|*l(1K(XqX=XG8SXY$@NRzv4|vG9_b#_4p1YPpfBJ*M!=suyuz?9{y1t z<_ZkwQ0*%W)nwk4`s4NR2b~=sty-oi0TfDr@#A$94IYFD3;AoS7Tcx|6}9KzU@sLK ziv{%$QKPC|%v@T_=bhV+O8%DR=zLF2!v)jOG7OlHJ+%EWxN{3vDh$MK^Si3cnu-@U=2gnMXfWv7<#?lph=W}b-tWTBbKP4G5BC~7$O7{~-nm+IqsM{0bGFj^H5 z<3(hD{hmP`0PMcASXfKv?dpmwDo++9n^k$=h4M|lyq}F3sw)wZt}jAu&C0BAVyIOP zB&#{`ig*`pgOK9#YBW>2i{fG?N+im#$nzyjKWGe=P3`L>hl+7wJM3o!@QZ^4bpbXI zXvfmJ(8c9KEhMk=V#l9T3+`shAlpEX@afaTTmgyNFgoG6y|Xlc$BIp864tPFcEp_>N+EX;c4FYF{xgTWkbj_ zGzI9fSFFlibhYVGfAe#ONNbmH4^x^%d=(3r#mNQNQ=%KCRVWv3BfUX*upDCIvOaR)DN|~YsMU|+_rl*PzDQ0wHcLb|)ep9? zo)(<(86S=3*2LJRHN<|u4#xA?)*d>HkUv-q*fasG`vt5fHW3dkTPa@yR0A8h&{X3l zPa4-zvjJdz!`qjlyVS$g^5y|sge5X2^~!n`-8Dkp(<>(L)l)GpJT5iFZL+bXZdfa| zU?|_nKDD0LBO$#k_}eca657dG)USEo`QA@!fSrR@5_ru|y2cBWkP(lvC znyIKqL(N7*g|=P;G*&ZMss;;<(Ho%FEnL7`Lnm@?iLmV1B1}}KQYZbve32Zzz{VRT zBY7;YWm-*`mdtIrpJ|y$z3y7PC{efH_E0d`CaJy|&Z$PYWW=lqXKvsV&Y(9bK2x?Pd3#p7Z?K*jUlrE^#w=)!3Zo506w6 z-8kd6)KXg9fUCHRpLeN4rfhyymk+6#R#$Qq(uGFfkO7@skM)2}BX#olMOwDCi|!em zKKcB5Df$lPZv;CQ0$m(dljACGSfT_BZOJ>7LnoZH^(yTTqC#a_b9*{m9!NuXj-H)`33&Eutvr-r9Oz)h8dcHjzj1L-fUUE$v( zn)#ms&A(;m{#J9#`bs;Sd)l69p7IMveCmxp7*K9`#Jn(D#CxbzrRwjnu%NdfS6x?J z>~g3^vP2o31^m==-lSeG=bkd&r^*aP%rGB}dx?szt!XI3?nqSeY7%$w4YZb_;QtOi z{vRYvl@IJdNRJa0QjH+jxBfdE-}Juvyw5TW@cpZ59xRN(_LGkU8vJ&sS8Hi|e6Uni z;CxdEEmwJi5IYB_U5+aR%{89cxuUn+?GJIZU9R5_*4jA~e~~87-ciF!w9H(k zeuoUZ{PmL8^QlW|-rCUxQOh5D1eoIWg73x46{$D%5+WqueaA~J)0GQ910TbszM7}T zkBxoiUfF}+?e7zKtpuou4vRgUO75|`qEF)vzMPnyD*5NHwlI}IqG1Ur@bqm+%Z~G1 zpa0Iq?cvqc(Sq?}wYeP@dWr@D^l=^;1_1u0)9(2{>9zkqnD>7dd;jl?`<_veke;6z k5Pbs>ND<|)yS_y7@Rt59hfH#bcn3*dT3M<}!sP3J0KL%$aR2}S literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/12-vm-unavailable.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/12-vm-unavailable.png new file mode 100644 index 0000000000000000000000000000000000000000..65fe836046fdde412948a817d988de6d1fc82e17 GIT binary patch literal 49592 zcmdSA_ghoJ*Ds0{6#)eS0Rg2-@4cz?E?qiEFCo%PfQWSIEl8IxHPSmMz4w|3kzPZG z013&7-}iZ+bN+yH?|bi0`&oNt_LM!d)|$^}t*G~!O2m(79uW`_5UVK5>kts!5h5VC z?egF@{!L+v8wmly69N_aw|c%=`!^3wO*isnv9cpF-6OyF1jVdA{|w^}Rd^77H{`cG zd2C*tq*CJW_j5}!PHIl?Ds59!8<3nmcUdPjN29JCCb=^8Q0In6?Pif8y;g|3f0IwXGV+>c4Q>?5>m>Er>U2Hrl9zAqUxUR(d(%VOYAtrH6UYCxpybXf zU0*Y-e2})4R6pEpxPIR;WKmDE^z17B8SZqhX^H*OU6pTg0(bCr|8lE}39`6r1+o0B zV*V3gdWtqv(@7?rKL1^MN33_Mvx7=hh-*M{*`}}FN4oBnnkE<8Jm`GMob(pH@#To= zrLSHNxhoc&!)rkyu+zus(buB+8g~OM4gOo#z#rxy#b)?(obfrdX#?AO(1Na#bgtRB z`>)?xW{4`q`fX|k2E($HPIU3ONO7H*?I0{caWFP63OAYKFcEs9gCPX1DY%6OJr~t{ z5%m@9!a&s<3mqVfwmGKfrKMtv8PlkC8>RDs3XyfywWHDi?K1ASBK3+X=FOUGIAj}t z69NI9LE(<0@wEy2?+?AJ{NADoSW!;izAouGoGd6Ob(9+@0tua zDivCofo4zszHekx{~KUBu*n(ru1a+KnfqW;&qOp_1LrUw-nHJq`C{e4m6FMqZYIZl zU0gq*+7~M_1`?{&uRTe}7`=mP@X3a4pIVXqzGW&^zYH@477XujaGPMB6y6?o)xh;)hyT4)BN!Ln{@d7JA!o0kR#M-!P5vH?H% zB-D2Soq+EMdIYYE*p3>pha50+W^AS0gJ~aq~80a z>GKe7Z4Gn=)2seONISy?zsvdy{0e;TWfD$xy`H1<2@sccJ2`Mne1+QuH?PHkhGPXz znssbln%$-)3eH^mvNP_Zl?C4>Ao%%>(PaWEP(o{6qMqnoYBYF1 z#DOj&is-{N$Y1(Jv&{?X7ExJn(QiKP+)0bmlc60$n@Q83gts|}dKwbGdTaP&F!c%= z9b3qd>&`}II}5u?_9LM)hijJ;S{|R8yr#Lgvo$HdN+=IF_uk>0trJAj%^**b*w;gk z$7G4Lv~=N5*wu^NxZppmh=>ZfZRFotryra7IeH7Mkelje#tP3!oedB>V$!4!r7jju zHTqg}0#2|3fUYva&cN;lC~!FE6z<#@cmqjlImB_pd_~UY30<+v-jcH4t&my_9l{Z~ zDDksha;?s`@nY`sMazAwf!mSm$B)RKTjfu33Tz%nd2u900{Ki5PG8Uw5R4i6&Nw}# zPTMIoP*N^d8)uAL*1qX^Xi{iopl6!VVWScdN=?0hn3+OE zvA@9G5ujUapy|X=SR#a8nfJa>7Kk3M9aZxhdf<^?S?@Uh-TuP+HtfqcY3l)geZ`Hs z(%D6KXO4P0$;PRo{8=4?X4dKNEY@t-B;XmL?bYp%o35pUmUOpLS#xq0O>Z>dCKXic zn|ZyfolQ{58MzL z8Q(|EQ?oTxbt!th>y$dABwM*8^-Ul{q#vDO^K1N&N;8U^(RQS$R%bQ%wQ>%4wf{GVySCikh5*w=g{hE7^ zqnPAFT~uY@T43(iKcxIU$MabQ-SfH@18Kjc50Xn4D&4=5%&!|#Hr6>}P$GX}?)EM~ zo;$uNaP|0DO#8+0{T`tt+x}c*+DAKG#=&3Y0BF!c#_&d87w6CefEcYmDi%<>NJ;@Q zs~-9`igJrPx-+nDY|XXHFJe-0m|1@g`;f%M=3c2Ojc9}|3apksg!%is*e|7zRa*!D zOc5a_3kpeNw@LiWTX*CQ{jc+AF(GXE5K@vUwCW=5)0SwJrWHg^11Kqtrg8uxhpPB9 zpP5}eK}=iid=-v~HG1(|C$KFm=2|Lbw0e7O4}s`d-!yGEu<>vlRZFc3X(g=mw6vIi ztLD!QzE{O(%St}{d+CP6A9h^Vi263@^7~p{GvkhbWgS9kIzhQC z^{b4QHk{zwu!qQX#?RT46a@i-qkr~ z5gLtDMVWCht^fsCyr<$ z(pE>Wrrr9NP{9yLtE;V;FuNvClrqa2vYVq-Dc>+6d9}N)G)ClGI+>i#v2R5pmjE1X z$3zrMgSRA^v8Fj3<5i0l8Y~AbHyUVw9BHbpMXh-1;hGKTV*2RWjKE`BI&)_sC)-d~ zzGi+-O6Z5ajqF1cZ29zwQ9|~M-f!7}6r=<^VAJFAqHXiNYpj+_Pl^>pOyW}deW3tL ze=SL-a~z#UF@J^)eKZpv8h@;gs2{~=Z$B)m9ME@=gKSnuuB=nl;i{UNgoOQ60`_@q z=AYbvvA^i8tZ?d52YRss4XjO0VYXFnY+jEJ!m zjaoXpkJ@DmWDqjS=}e|{WC)Uo_wSf+=tqUb0P}xT0Ancn`;~G{B0s%Ctcwf1cqOpY zJ5By9Dzx8`N%xQaaZBhav3-8iF}&(Aw^~$WZ~l4F`gOVC1*)#iN7)A$tHH8mlXU$4 zgZv$%m&~f~kJWnb%14z&Wxh6{-Vsnx=3&Bq7kgp;{*#^mMg8J|rZ7j%@RUOkzC0-%u}ic*e)!=hvE-EO#Ohc=3hwOd8y1W9<~>gAZHxk`V$ zwlK+ZT>_+E*MCTEZcsjyXal9iS}`6MIhX5heVce8H>O?pet;^mx4efLmc(YrzLEIr zgTvE>r*w=mKc%DNfE(BWxWqgPSrp$rY(lCArD3zNU+=>iLbx%gZrxde5*kw zMmPL$@v+islUver26tZ;?DyBg>b#kPP^wcE|rF2o9d8dls?RDLEnXT`! z7bf?s_!V;vUN||^e{^xtB?VbmtT_JwAfAA=e_gnOuwkRN@$<~d`?R^3)7WHdLYR5r z^@d1myL}Fjnv59$kh9SznKY2bViWsSED_`uEvVQni-q@>>%xxmpewU+>_(OS)zfb+ zV7OxU;=7^Is|s!)ctHRuXn{i?o@-&mn$V5lbn&=)KRCk{HQo!6QG2nqBYC;`BgSje zwKI8qWO|Md_Cw^On{PnYOhUGmL1e^cPI#zdn|3DNlY8b^Q>$ToOmM^3^&t*DP2}!r zCKSO^4CU)3$L0v;7H!EZD7fuJwU0Ku2~`%pmVYQ{Z$Dho!_lrHVn;`Ox8Jnk&FeG~ zY(gaOlN4sBHHC(kR2phe#}m3&9z99tFL=Y2eYy(1cvYf>EKDeHW^Q`Lwq%K{N$&ac zLK^f@7Qq1G?{IpVF;WJD(|#nqTi2MpePiDh^zv`0uIC7&dBzJ!t4lzXW-V3Om8PmDVZHd&{Z(+`5#n)(t&B}XeTd|<(?z#A`=YW z92E%?`R&)qqCP#0!>aGb(|53L=@FKcAnSpFrCU`>3|CGXR{H>&eM?=F@uD*kDguIU z3|qC5c7;@9);kX4rXFao<`~&uz5!K#rGWX5UmWhT|1bx|`^7wr@w;93kOOw|%zYo| zU}jjq`TMr*H)^quUXJ;>=n9QPIxb_A>YZEMjsuB?|BVG8Khk)_PUR%m64}c`J{Y(2 zWPf{7(QO@4X*A;+*(_ODAV?H%U%d&-C(*|C`&LqyeRNSuWfP9Umqwfb_{I0 ztPf~KKC<7(){;c+minX|V(gWfAy=5Ud6+Q#P4@G6G-J6tKz#bBF>dm7do+}2eTWmd zyDer}Yh)LYla&QYGsF(E0TX-OI=Jl*s+&r1Wlwq&frw{%1AR~q8wbN;J@tM1!3Rv0 zW-|W1Z@fOH^a-OAbUTW={B*j?uI=8Y?f3LS)K{HA&f0$LAzE#Y zD%Q2*Pf-hTD6eznlSZU}^gf>}KaZ;pO%YG=`QE{rvr zoX&&}T+SA)5JHKnhDi5jLK|`?b2O?W+d!|~ZrmGnWRR1(*TX;bPV6%eN)Xmc*$#sL z@P%(LA*#GH-Q;fV2FFzfgVk1Up-gEkas5hcS&htp&--Kj*S4YLP>BL$u=^EB$+b`C z*B6Jc@C^w*P2F=A&-`c#rPdORgANf{BvKhAKAm*zvp}#c&9fV2jIgJ!-Ab*4^SC;( zc89D5MAQCjrfwYb$-BiZ>RV`c=-(^7Uvu~Z1eyna7H16rhzdB>`^8X%h_@0dY zd)~df^7xvFaoX<{gQnGa^BGWoeXy}B{<8m&YHp3fcz?nU{4tjiU3FJ~<U}1M~2A$3tg6bwM)?xb@w5*JYtpIof zs|nZQ&vrB**Q{^y+4A*zsZAd&PDJ>e?_{P+Kdt11IP+^)YYzIJHTt9$?NIQ|YBta! zTivc9M-Ct@_jr;fwsbK}{J}K7=iJ!w*I7^fX1NF$fsU2(&d`3nm_m?XMYsE<@+^J)!fjMX5ou%_ujNguMxp*4=TBSNX_{5 zm=4y6oK0(_Ww=@+9l9Ktx{2Tg?+o6I^jOj!fG&Tx8raenB)h{eA4=bh&}v-#-5LHR z)OqE3nwdP^x#1&Ro^;h!Bj?q5g|g2~k0L?H9t33tiJc9#i{d_|W%KCoZdzc*d8<}V zlaaAFuNx-#eoYr4?m{;H*$E2}-HkG5ZIto7lim4+F9hHPl{xNVxPV`IDrNQ@T<;Pa zK2xNc{`RsY+Oc+$X8>g$ge8T8zElgCo+2ZhS(A*$X>r%T$bmgAtUFEdm{lKCD*I)C zH=@7?fZIX{CC^NC&1@&QOzWbS(I3&Jn(EEJvs7IiMDXhDgJ(3um`lX&x2_Bqg%x3+ zO8@3kP0d!J>Fs{?Y1!~cP>vKWYMspXm9bW!vh;bd=`gBe$=FxlXbyLMLJlvE$g88x z!GKQ&CpY>wgh_8sjL>NZfz8~?V9vIcDwFbJb(1`eQT76y0R>Gb<~;2xKrwmI1B~g7 zt!{SIf#073^HC8*?98=Nm-#>_mF_q~R9mbHVr9sfnkh)LlGY1pDyQk@7$-%I^Gw8e62Q{*bL|&Yrb8d#&==w8JV9X{k==$%bK(`+^2mT~;&Dc*=4#F+HmVj7u5bfJGTF07QsM z3w>bZ*>XV4(Jj~=<#mk{XII}OAX_qRt)oL;w%f(cVTVdpvt74YW~V9|y`8dcNFJ+I zT1WU^aX}yh__0XxdbP0w%Y_KJQZzd}#9plH>z<@nfAY|9d0l+a%Vr+AEQ~;7h>C>E z4~C;;Hh%7gwG5WLpd^N0>;a{ZJZmEy{9`hqSGN#zKQu-KhE#ZI>+ots!@Zk(KEUfV zuy4WLiS2fYR6UnIC(v$#jh4zNJpJjt5M7xh=c`*GNTAfQ{30)XCqKxYtCGKDpXU1T zfH2eCZy$}rn)CXL;P(^dyuJH)I$nVt(zl%F4R0*!mtP{5@PDKrmOGO_rTDA^fj#ao zudCI3SCzf^No1<7ogG#_&?j&o*Pf+>W)zjZ%I$0tju;VVX%-Ro`Y6-Tu$i;aZd*}V z0*Ex#_jOlJhp_f6#KSUj180tFsdcA{DW|x6=~rCdzO{F-Fw?5zP2$;HN4i%Ju#C5C zq=ADjV2i-nG$rR4t3};oXFH0a;(#83>Rag-^Bv7Au_bEIX1i0EeppzTZJ1;A+d5kx z*(+b&={wQ%iumbt{FTW}n-Bm1JE{-YV=v{rptHoI`;*Dk&K=hi@&eW*?bi!*duotP zC~m$*xAAcN+onyH826gPBjDvOG5KJHJzSU6)FLsresvhUontMr^=j^qC;eJ3=J$`; zF@E*Wwp-g6p_IV$-%&Pw4L9deAkoxy-pYW#(1ucS`v@554|!(^ghKO>X3h@Ek)`Y% zoOkhR(`NS(iEt+>f{o$oIyqx`CuBj-$0o~eRoe~Pz+%$RXRxBSH3kbwcRaBJX3{p%P0_RS+vLBhi9F&-GKkXJN z7VU3bpQdMd-}D7}&fjcarTNtReSyvF?;PVTEUW{_SVavDJo-&rBa~c_=}aGRITy8I z3vW2wdq~#ohm?z#_LU2^QVl;nt2;L(J0!%@eND;%2GFSou-%~3Gr@fhL3r(+Eq3Fw zWXWPoUXtx9Cdq#^&zk9pTrMrz%a-f<=nM`YV0MWCyr{zEt8FG-iwac`U*>XU ztr_SJvFOPL>CJ@?EDeDaHa(qfEh|=fTfEcWlGEz$KwVc(A9%8oci8z}N%CB1vnGQU zZm4~ zX?W#P2OC32fWHYnycKyxC6Xph9hj+jQHev{WT1;Xw_@ZGbH``plk))%way3rg}WU} zf27eD^~8(M4R}N;=S&4B9}k`h5%d3ZJt=4HDaIVWZ3m)6<2xl$^9_N(xkV?}b=|MW zWlC7zS*9~W`1jbtY=G-=U3+WgPF2K5;8DvS4vXaJ@_`fIt1B%rF8Klh@Jb!eci98i z4g*9DCgtB<%KUoE>IJ)#nNv)ad)ZyKT`ojsAbn<$D<$M56U^$)vtQ>c?Sr7w$SxH| z$(ncL-q22uwM5Kl7FeSyeU1lJT6Zmi(AdrihHrUKMXtX#u@6sN^jRYWwXk6X&2Cp^ z&Je9D3H&Qm$9Y%B4j97z3N%|UXw45gn?<578SIEh8}EW`hD=xnwI1Z+RLSfi>wKox$tH${WB;n1tJi; z3^_RV2#S)a2ISv4w3)Y_XxJO%t?Wdx9f}a=>_*xu`Db9UebG2L42Q0|}K#lFkdxr?qz*DAVaBI|0BwoD-_Xpj$F6Ggi{GGWRv7By5 z>j0n1O1CoHWd55ok0zel{*_E6b%_9jm|@%lm^HL0_(r2mkt{5c_5gQMO_wmmls4sZT?Z=xgor+Vr#kg+E@CVT`$w@OTZ%y?I#O@ z@FNjkeDS4eWYJV@P*iu(TP{uG3_udO0i#xek|2kq=XN&&vuz@KiK9_s`VX&r`Wf_J zmnwNNE$9Ex?Oph5E5YZ4msxlaBlV{VNRGmDl`I%+G%bsbhg)9M;k5nJ92UzJ08U7`w`)c9ktv;BfBjx9lR=s)9UD)XdmThEy_qT>bqOj>`%{0 zGsNBxGZ~s5Oe*IYf8hDTi6$G2-n?DVP50Kq^3^b_O4*OsW07XvZg1^omKWimKeX8$ z%6965?5Y~7ddfYfz9W(nQZopVRpO@v1Y)Go)MLz1#Wvh4k#i~eHQxSIhcBqS;~zIu zNeNMXx*$nBeMW=4K4LJ#XpsR1H+mJFPve4#nnS00vNBemmA3nU`y&NktE!K^9%Qf7 zZk+QHH)3q%D)FsdV|jxVcWBT4wfm> z0GDQwA|W;=1x|9pc1UoQoZMqh9d2$e^H(%KoQq;5>KvImS(PT?u&F`i8dbI0Zw++q zkF}{E)lN;5)gNQNTwR-F#3!5$Yt)^y7ql?4JUgS`+omyCuNY3Nr*oovRPO#&EiEj& zfUI7THSsCJ5;*@9R3{vK;bgm!R><6!{JC3Vf3n!AV$@5{-eLD?sScD&qd`Q}N0Bgv z_K|aKlU#&^%*JNcQvf~Zh_XuFJ<3UusKkZ?>?@0J-oCcB>CeWhT1cELu7*VZRI_oF z4UP^q3PiNm$k*Gr6c%`i85h0Xa)Wv_T#K5z`56@MO}u4GFCSAN`cbu(CBn%hJpAU) z%e+|6oAxEZSTn7u{MTU}K?n;Q^{l6Zo$rrEKL?>gWu8HmIS%=vB8n^1g-Q6_`m81- zR^-<}OsP1_PWbj2lFrO*N!`~9{!n&=VmGgavONAZgwn8LChox5f$q^)A@*Kj_K_U9 zcKTVDS+z7tb}xmN9RUf)j@w8=l6v~wsUr^2^@>d*bspZzfm0HO-RBn*3In66YI*}* zGVo7_!9kK{-CI9f>|G5RC->pnI(-}B?5wHGWY3X@hpzP}0PU$l%=r~ZiC~2er-QST zgXiD(^FIZp0Bse29w)z3IN_a-=nhUixRJwjeWg(0RE@47qX;#Jc=oHlYZX?5s?(G@ zQ=df6s0r5KXU;lw86Yb$VLCrNGI`cpy`0!!jFK-bZ(R7^xkzqQa+_V>wk2PTEmzzxAomSg z&X9^N;(m*F9e)-_^XrmNEb}$?3qEb-lBGh8jI*tX(he!M$!SCYmp^0f3oSeK@xg@0 z3}Q1M3$`r7Boadx-yFVjW<-{h=kAwedM9TqljZ){1~@LOZCMXgjt%|fr|W*JqT{r( zp%NSi3IF{$QZZt9mW)(fwst%+i0jb;8s*6^6l!C$VVc8mCPeD{EQ+0DjQ?*Ita{tS z7_gE*{FsBC{JHIyN4f_Tf8Il9UC((6z3k^CsJIJTm?HA# zmc`f7m52Cm%x(y8GXiv+R1AU~|4sy<2UZU7Y)R#!)M6#Oq<9-Md;1R#Gob}92T~>h zyLEGOQ~3;&mUf$4aFqqYA^9Xnr$V_O8XRQndaU&>11e-m&)yd2LcnvoUePndH9Eot zW?leIpM-%~r^PdwH*?GF5y>-~N!_Cu3C6GMoL^6q+uA{>*t>egNtiAgBX}GMXuHC& zk@;2q&o246Mqy817Q2k8nWV{S#Z=Y}Ju2#jytqzMKZ@{*uYW$?6R$%IMJQFPXUZGz zkt_x>dTDBFt31*bt#5~%o_n8L6z5D;vg=GHF|*RTm;u0tf0J}Pc*h58_yOIz#tnMm zF%PkcQuN9y46RSz+7rO9sL$9M|`{-+%4zr^K#pbq><#_ zHXF@T#K0tsUtTBLDcXZfsg=~o-f@Ub<=IzFjr*DK zT;UXQRhZy2qcM|KYU8e-&nh;xvre|NZ{w7l(UjdWVLD4|=31&w85>zA9GQ;0FR!0J z_}ZO*hog|Yf+7{d@?O8q{Na@91SZP)GujR ztY^tC#O=qg$pT$BMh(rp_Vml4>aV&31{EH)u!o1_snsK>2>yE1DRbNFc%A5YEx;Js zgR>jV_;y&>RgN#B`kvDWvVJ7!cMAahiqTQldlbgVkAl@Vm&g#^b!hVNI1AW+L1I(! z9uzO%3MnRnUAOvs2tHCXgrWw zALZiM9p32`>^puVfML> zLp+?K`8Qo9)9If+VUuh$rJflXz`#J!AW6h+wQy{aIlnpiC9+_ILx^SaB}*KZ{)PCB zYZEn*g0R{#J!~SK|+2q^yvzyMn;I%sz^PmIKC;=NwRoG$5Y^+&lIhdBx}8dpeXspll!&Uz>P}2Z z@I6_a@5S3F5pVDM$CDd6EZn0*W{H_AQZu%a9u~HrX2w2+4N}8ax(l`!?-De9rz|qj zg`^}hyPeTv;Ii0b#eIuF53M)VGli)<4w&!B-VsiMsv5fsM~vyP9~&Tr4HfFN66O1n z#;7{)MLi>mQbE?&lgzA6mu-Vr0p?l>(MQBQ%<{a)wobEMRKokT-uG8EN?AMhRFe|2 z+!wpLsHJT|T>^o1KN!Pa@d_WSw`($1N1n#UNwnR9B=2aj23AOipI%&$5R!S6pXxg1 zX6xni6|Y0bMCB{m>FP?<3zb#Iht%e#Y8#Y`TSii}9o|onbX3>M@bdm>ae%A$h^kH# z10?e40$69;{Bjyf!vY($`?^KTnQd7#&TN$&Ouj28im6Sf0Vj5Kzv<}adlmB+mMFK~ zFcE{AKZz)xQ-UHP`oImQ#nBrEDW0Su26Z_vMSY5n4oGfdOsW zH#)e#ZPc*N?9-B2N-6ZLMq_#6n*i0XQHZQ3NPH*2*3Xf2AEXSXOQ@O~So*^wW@{GojYnx31Fp?@2`$ zOfM?sZk9RljpX4`R%53RbJ5Yso{l4_VM2pC|4Nie`n!U5uZY_$S4M^goAM?5bo&5T z`mf&P)6*sLsYyAVTxs4_lL0F?om9_2_Ph%P&!pMT@~J#W-<|a*nc7N2r5RH(QB;(SrCyOYSgxbDO{ZzT@az zgR4v?_gNi%{%`(o^bDRSfo`V1e&1Ej?|ItJ>pZqgaZDO8^IUK8-il%+9U6JMtoQu6 z_{2L^cOp?+h1|J1?^%?hGup*a)a*k`vCS0=MLEyb;jwjA$I(t2=PP@kKqb6Wo7$+D zJNIHAAnmdd&BjXf#;5MpVQO=#=++d;#$2aQ)>R;jPFNmuqaFkN;L8|O<;~bVky+3LjnCJmZcSWx~~m&cCNuqxns zr=;UJmXL(bxW}?K5|yQIV6YU3YNr)(dGjwv;IrDV;5&p)&QR>GVW+va+dU(p=vj9~ zkYFPKO{ih_AJk{6#=1YQyvlgAhRf(KzVzZW7bgqLRQXRQ;zH|~elRA9i=?IZK z`g~rQImu_)FYRBksXG_taEZK1sk{PirT7kP_DABxA{T$}e(meM1~#Yj)7Vr$ zkV{1)gIVdTv@f+LjH5#lhz&xSqZ4UA0X(AcN#&`lSn>|1D{fNlaBfy1o9^`D%PIsGNh;f6Z3}tJ86T7{yk)rTiIScbw2mtQ`p7X1nl=mQeolPp zaCq4i#{X;{@|;oxa}+L{y_U-wt>Z4ZnnhuA=g%ac`iZllW{-%` z@(uJzLkwimk}X0$DBuci&H?(Odt=W)M$3Uvy06|5OF6IBXtxahV0Am(;to}$^g5BF z7P#$;WbRKjBd`eYF)YFhbHp97D-(cRjBvg(+7^{=JqOBuppK2XvOu4@2Ca5(uvHEI zxy-g`tEoKrHTgjok*Vb}#0-JZ31z41ZDsEkrR>ZHY|XKC%Qy3wI;fq zCl_o%=*eZxlJG$I_0I(N$CS7esisUF-vT zY5G^`+IhHnRu?gygg zaXL~g`@8d)?WJuAf2381l3wj9c0RusgsO&(xBn)?C)(_*L>@VuI6I$SkxRpmhe$h7 zBe!JYpGH{QBZ9MQi4S%vWi30c)x2ysb0s80>ds4xdf$DmtxK=tM{)p>JnBB(2nk>h4#l=<``EN9JdvQkGnS-jI5ff1jW$W(Nm4*aEm2b{}0l zR31&ta6w8~GSc@RT@O`o{;a8AkIC7}$t=*6P}u~G-y9q}br13q8>N~Ay-#xV{fj=Y zoqZ??aQqT@4rH)2FmOIChmKta4nK`&g*IeRW-gGrR5sq-;It00T|Qevv-R;&AdjqffX`4UT`Tzf5SoIyIKU*e;x;apI$22rD?>@KVHsq9c*icqF)_qpi5iX*3O25Ef5kM0?m|47%JxV3!X`<&%~A_YkeA)aaA>vT5yjg}FUcG{-b z(%WP>Nb?Z}-DpUpaf_Pjww7(?S=6gnKGnb)=J+0P3Jvxp8I?qYSF7L2m6gO^w}Tod zs;f$kbUjW5&o3+|mTT62F1>%(`oX@At(p#ZK4ENpXI|>e{Li)co_xVz=T3uzKrI*p z6s;;VuD#fUo=qXvdqtOW5a{yhJ)071f1yXlBtf5kX@Uo!%PG)2>3Q1n+RIYm0N+ne zksoQyuQx|&fkC?j-C9xw0=i7ewt9$a{)~}p?8&*8aJeg{F&?Q~vM+YDstew=jA}b+ z9mlPHE+FwH4q^|cNCx7z*%1k8=^a9d7l4*M z_|mU_IW0u+oykoO*kjv-T=SRdtb&4JxM1m{5(F^TyM5|@TS#_*)WZwm{cUSvPUzSc z`p-zO5&2U6;SB0tNH-zw#Hv3lda)7B$DQcCL5fwBd_+3ael?}l2`R~*qqqH0Q9Kyq z=)1e(Ah4!XGjlqrmjgyI_#6jj9ClocbWSK!WTEeiZT_+_mwlr~bLK1W=rKQ-R2XGz zBk|EfLc*INl2vU~UL!~4)8#LdYR`sZ5!r&vUEu(c+WnyD3)S3@P~0@9q(nr7q(p%r z#QCvMf4Z7LL98F0S!CDwNrshP~-#zA^TK2Xk&N8CRU6Ju{;o4 ztxN$8O9s@_(;>&P-V-qtwgWWjpR4)V1y*N?Rvc?L@!KgK(zzZ4V`Rw{rflZXO)1f~^y{fEiK zz;4^N4p5fwJq&1suB@enciLl+K8S#wNnvvS?ry~UqS4M4F_t-a2V#RZ@1f`dhTpq+EvFFja5G@$BkF+K=I%J& zoK}!+oq&x$wJt7#A?W;q)^$P8W0;)yap!Z+g6h=b+IY$5g5W!UW)`#5-=5A5K4ddf z#M%R7ZW1hrjGR9LK3&AgfR5@UqIiA{p>x5=dPDP|i;k$YG;!nQ{I{tWqzF%(SAfXg z!m(9!M3!5~PtP+2NpZn>dBX_S@|FcDz=NBNLn-?9*%+(*%5d510|{w*JiYljI{691 zgYP#XfICKl_It8=eLQL+aM$H@H=f?!!+hDH5SyS4DySix zj=K}QkHgFp0cSgWl^_i#gkayp9INo{+Q;3U;J;Xh@#2!hHN02;2ai7;qwfSrG#|vN z)070E`&UVljM8Q81>=h^@wwIR(Q`5*JvsLyDXqjZLRnj%hFs9`20-Po!@08=oSip+ z#utD=htPFSUd(aMdEfctb4mNx`^7igxYOCFemU&Ps!67K z)1XV!LG!#CwwFmX^NPp37>mLwpr3^Np59$&W4KRz)ypFEJDnSxzY+uW((1<_@q;GW zhKc=^N(Rp?@yyAO^PTl@^Y+2-W>;&7c6TpmTa&v}ernMSe)K*zCklSMc^1|9Sc?8x zBT?y-kn1sqphz~n6a06TX#zAR#SNADbQ&n@xA%F&21hYHe>BGlF3Vl>lw1qv(6ZQX zsNHr5q=zwkTCP4-0`>o1UeNlDB?X`G$r8b=9X53zOoRUN%KBX*3hX`mgSR?S?P)T_ z#ID93lp1zi*;q9MdO5nP~g#S9q^DZRU7-BSh=H

zrYgH(>*Cp@ghldV+#OF1H-{x03^L0@lIdi8|NbFK+%D3&8(=ov{C*#Qgsq zApP#u6r~=t)4SCF>0D&b&$dlSD*L1B0s+9%_3m&zQO@8Z2|iFLTBL}XDy2&=Xc!+T zrZPYk-1WhKx@9%x)O6uqkq185?LRr-S2K9^*&L0bf14c1X7VZrWv@J zQaUXx%^Ys!GyJIKG)z^LXcQrdb6am4&~SF<6f7zUJa7ToYc=jkv1zK62|*ywHnxRT z`5#_q-O1)A4pDbFDevlPlhRExesLm!yc5!{6eoFGS84MD{CN4hYsFwu2fNQ0|!DFP*J5 z5@E0-&5Am*n<38O*nSj%uIVT3F3VaM^p7AgNHFe|eTccOnZ=VbT;awv->u7c`M%6hg6gl~vx(?qH!&T3jF?7^MAN61U(Jv=zk3DP@d$->8UA%O2 z=wm^n&mkMAqT=;nilKg+U4cJh&f8EqpR=-JAo>FhN|@A_$!RIcvtCb~SGR=wsWZcV zJ$dj$!JGES&6Z7{*L)?L7Zez8p_jETysF*hjLr46jWirkbFQ0$(e_ygm{(R7RM**H zp>oR#8n!Z(Twk+hPQ#mG+@3@fHG6$GO85yYW9rxsO8^f86^X?JF~z2*m540Cx7;VR zCE`FI=Mq1C^P)xl!>LqWT{z4eReh53C21&T{jTGH^c3P#lgENqh{;%=svPPdoCo^| zIV1e>eRJK#kZsQjq;yvG>2y;`HTXbnx0&_bwyzX7Zy2ing#oL=LGi|?E(+!GH$OGM4RCOs2w@Djf~ zygj%0?m05=gIT&v6A*p;x%zU5h8yoSlBYZ>T9}`Q%{UZ=k@sevaCnU1>9lX=of7Z{ zktX-Klyv=`fZ0v=j;lk4Lsa;PUs%|tO|t5i@fg(vK!X?^#LXD>&x?(r5bLH|mo2U(i{>C>4cFfrC z@Xfg(3E@OcO-%k2SBq)gqTuSmA__Y>ty|xf)mSDWZKNRuu_ot?u1Z@h?n@Jo@bbM9 zAm3XFM4O)M=dbE`BxT&qnj5?B?l&W9{WmRMuQ5sQanuJ>9aj9_DY%`yl~T`7&USlr}{;Mw@#@*0C$-hdHuRJZz~P z<*r2XKoA0kEGXpSJbk6s(@uSRKU!HwN(uniDvgXI_2ypCN0qLb)?&+xMw`j~fsj za+|E(|6xawVQ!u3uxo{g$ctVf&7y3MUC4LcNdFL_(8=gFkmqTxYdOvXl~eM)80l1v z7HA?LZFBjc)*Q>mOQ#qT+IbRWq4THfi&nCkcDRIPn5Ol|(52z5KO1Xf*g9_W`_1aL zpPI`HoNCm%x&*l~8{s((Hr?^hEW6~%!6+CGFGX9fE?V@^%Ks1fcBMfAv5lWKj%vVJ zo}*4t-6tPOJF(8^%$g+7(wER7te4za^D+GPAdjG}r9hTRW1_0}?BY`UFta|y|uNSYv<48bXfODU2>*LeL2rTErfi01X`kQ?}An`%2)Br>=o9P@h(L-;|Qr? z%QW+EBW??LW8dGf@wl4oPSBsV%i1Wrf($<#b)ln<2npEEXV&3bRqu6o(x6Kbj|cPY zr`R@sWa)=QF@>rMb0=%7b6S!hWyTeT6}bg1I{dc3X)!(AZXm(kmi(I*H*oOwlGa;g z9mNTALrGyLiA)F(qUJDP-#U(~U8GaRqW^o&;|o>44Di?MDGvd!?gf=J;z++kaRfL{ z1o7_NAjF~g4a3r0ST_-~;%u1+yNR^|M9+w5_u!~jDCH07Ae}CQZJ-aT1@x+4MV9>K z$x!81N0_7RSAc-$Wu~9oOPUHb!q>df&FOeWV7rJ~;LP&Om~O99G$2@~Th;{hA=x9w zOCiiB$K5U=`G+cN#7XI??@|5S^YjaTmSQ(Wrb!0OWRjBsbyEy*Ock==nP&Y>f`41z z$DgH5?e^lXn0$87Ia=9WxyI<&CwRt1CiX~*T*lAFBLmo^zekeP!3~OLq2b%VPF%W2u*VA|VM^-pZ2?22HIL!Wh-zJ~IK z&z1lS9Ajr%KX{Z%LQ?`L3BM#^SaDwgDyrh9MeG9`U|jfh0))1?`qa`DcFUscWMk-8 zd!FMs&T`~z+g%i%jx-T+yA7HqK~mpUi{{O;+ll}s?aggtounKvjE4e`^jm5+EFtup z!O=GhG^bTYBS&P%%EJuN7IXPLjBgFMf2yWslqA%18^uehTC0}@sWj_-f*}|ShFPon zeqSTOXUz~&9m~NfqX0L;QrE#jW!a?b06w8YWtKsu&)vBd>;hGtsweTbH%8wDM#80W zgO{0(tixu?UkV#b6#>mLkd88!|L~-V|FNg^ z!Nh70Tg7nH0G$Uv4A3ismC68tHrEYrVS73ZS0Eg9T#BsVW~5kN*D-*RQvn|D_kIP* zAgWdUWQY!(En%KbnZM7`PsHd%yc-N9LfEh9f-A1jFGIJJ?hlUqdA3TY6|OKh-e9fX z`64+{=eQ6lu+r*(UP@5swk&*e(CY9eDgW*ZN3&tMz<@cc5{njVS1lq6tkjqSa8zHn zF`Yh^>Y+AE?J&>uD_=j3tYzzQH$)Y2ovVEnypkahuG?_fuZbgC$;t-%06v_>ckZl6_P)A z(-TkG0`<$ev>oPdM+KKXM?+pFp!Dy!^}=9=bk-@hqwdIK_166q^PknT>1Jv%y0%?M zd*VDhX1A4xCS}P%Y`xy0t^UdU25S6>9~(Vq7NpqIt#1rQ?qT_easfsFecminphRJR zh72Q(X6g{jb+c=aq8)6YSUIus53CNmM`>aS`6uC&Z+l`GPIz_T=U6gdzAh+HD8c(4 zNa}{M11w^Xn-{h1#Ol002+Wi>niwL8K2u>$K5evr+^A9fz0^&SrfT}YxkN1~gM%bk~G;YX`JbJ7_}_H_1R1 zYFNr&N~e^mw!e3DQKEvS87w0FehucChctup463>Xi!2~TD>&c;<&nSZ4;pcRZg%?x z*|FR+Fe&vQ*IG(w)9v!_dw+5bwZj{?l;yby7|w;Et(aRbynmmnSKiU$(SZE$`DK?BQIh9Wyyizi9 zY(gp(DsgY02Q`F)#7xu%s7d`!qo__oMtrPepM9%l1#;m1ws{muixR`0-hwy2~1QIewZBq3LN3#hcK#$ZR7($J_wks6?HO$=dDm z*hYK_BqE4V&%wm`v%%rx-CBNOM3=ZV!bn<8%Gt}MMq?UeEtG0dIYkFr^|4^M@~y^S zDXAmH!uWtrX{aY@(P<9I`qu}n35Pqi_v1m+bSq~?d3H>aAX!dBq`C7nTwE^Rp~q|x z_4H`Vpb=-FvFzMOI_Z%~Bjs(q(I&#Hia-ucGl2n0$3S6bK6L0?FY~fasZv0D$$7oR z_8I$$(3T3TAb2s=B$;5G6%d+$ePeuxc9MQzlMH0iWW#R4!j*cem&36p>yBa% z7RH-S8lV2|AN7-plT)q7opCs4-f{85W_eIReNi%1d-V@q*Rr{rM#I%0TV8Vr)6T{7 z;w1Ylahrh|lJKCw$15^wzik4I+*V@W;GYGnahPz?WG&q=Yzf&RBEmyeSbtHZUzbn; z7M3N=1`U%E-g&rgsRUQK9^TL}eBM9v3)p&5I|$DavkPYq*L5#9(>yNMdG?6Wm;y&e zUivlUs-6J-Bu|R82|G-6hkg;@$l>pleJ0K1Eb!WxdR@k{W_|>9{ea)9! zc(d&YGn#+8deZ4KzuMr2s_@Dbe4V9c17K2*tw?oF#VEwP`zD0uEA}pU?ctXZ^|#6Kv$C znd1jX#NK;{tXr@YrZika3l!qsF?Pg#r1RD@tQQ5zMvVL_ivIK@>c6>wAAX%rU$MS7 z&dcd5$THG%8{j#Ca$C(!cd2d)EDhDKUD zsjg$6Eh^q}i=vumXRpY;eOygm!=y+!?@ePlJa{%-mpvQ6c)Kl={11|aEX+a)lJd&a zwsO-~z~jeQMiMhNAl7S1LM}u8)w}bHUb4Mkrw-qZm|)VD)r2B|Z&#=sUbg4MU@Tvg z*qAb1W!mKuA8J88gwoU`>!%A0au(ZpY&rx&y=q`zeI%iLt~i_9#{+d{0Tw22CAH#HkiY6`o_Be3u9)$T25 z1c}&2`^T7Vd6T5=23Uu9@T#VLk}&DxCURoI01}W>nD3H z-zkqYY8saO#WP-gD!_|bxgByEbryfhM;Dvv(=`YqWW)=cyfGlj;`w9uA?#~Nt9@sK87NUCY>tu8JyzMx{$pm4_*^-kkk zV~&_CdDYZ5gpGH?xJTT5X&wpg8OU_i%GS7)!USl3bWB=!zQ27EbvtAprax3I5IVSt zb82Yrvj0fbkZ|1Yk-%GmGCTtOn`rHHu$NlIn=`|wj<=x#@o z`jbL>Ssgu&bk9)$@-Sq*8kOM;gxJb@>DDQ|k9oHA#%>*MVaox{JKKiV z3V=^q^D0ODS3(A`QC(Rx`$zW5RZBmYH_og5+eQzUVf&?qC%*nO+g9TD z;hTR><*x=xMR^#qX2cp-p;g~b6;T-;W~_gqfZ&330Sz#R4KkT}clGp}fZFi3qJt{|mx9+LMA?NyyN$;V7Llf?18 zXQUk#o{$te8s>U0e}p@`calNx5RHzV=|3eouOSlb>HRXIhlya$`vD0 zKLe<{yw5%s5bsZn(1%?)s~~kL3iD&R37yLDqyk=t?{2}4pn+1h($>(nBi8F$hIOGT zai(7jY#f%qb?QsQR)oi#-d$^7COTVJ7&c3anQx9Xm5iq7^oa|-?bCl>$Ct4_95MMf z+#XI!Ok=e>^?lqndQ?c+>#7?kxgoK>veHdOZU8JeOm^Y&PJ5s1yFeeKyLmM_iLx;ywcd zNeQp81K?Pz6CZr)+^X+sEKed{*G=-Q$?^mS$1zwC>^*rJ*g*bz^)ztV_lt6jLeb!& ze$vp&68;GQbK%0^Pu3It7nT=$Wu^GOeh#YgV~`hrgr$X^Hf%VV2j1L^DXijka95mD z*Ts*1X|o;;6@T_f0<<&pS9kQkp(X<)I$6~(Cd9|TKwqGpK0=O?%(IV1KhbGsdb-+v z{;%xkkyH4<;2?6xhB4Ai;}<|4^WWMzqXC<#-5nd+e~%d&mg$!LWl%gyW{Q?`J+om& zYoPE(B>4(-b#yE(3Le&}Mf+&Nv`X;$Xg)F#h`tR>JtjcsNyw9ig0!|Wo)6;R{WTE z;hf@+j^d5kO7@?|~!k0afIp*&}XF8KO|81?GwfuPxQG-ubK+>=4} z_;q-TqpMhdjI~T;Z9GwUzATwf&w->6R8PY#dHl~0v5`YmUD$@*22g;+(|L+GN>8#p zzQ1vGMq`UKfR5e-6`{spE$%Vz%lGrM#olbf`jz8=I^syCk5m;oLwB;xsa#Iz%5Kia znoyA#v0wh+mAswF6&Fs(nTDs^6KqQDEI~@49?q_9vk%9uGEV)Y6faGVB_^=8EW!~$ zBkY_IWJl^QzJcvSq}}RlR~xQwXX#6bYXHhcm@gBzyl<8{AFxdGmG~YB5@c9WQwUvj z&Ne-Xk}_lu?{VXp=zVSi>{-Ub`ZL((krWS3<^3eBYNGjJ*JS)a7 zOzxG8`@u#e3-;_WL0y97*Lb>}YoGFQN*vRFxK#oyIlUXhBibzE<0Qd%Bp4+ztd&jn zY}3r6#PN8(%QP^gC2pHXo)B-MqP@`@jP(0D;%w^xoQTAlNX2;DPbJ78PR2PI^imumY+wN?$4>nHH1eAE4e>3N+S%obMC`(N8TFzBGdVG&n_ zFDPI1l5UjB<83gXzCj$FimgYE?OcVa-8p1hB?NIjKEj_&m~WXTFUF1hmTPvG5+MIh zrJzPNJY4-p7aiVpS#sU!($dj))y-(P2HHvud`wK4lcTS(7 zm8Eexov9{8MjxQ_o=)|WXStFxlH9DeFGT&?!=FQlk`N*S7Y&GW2U9u{##UAK;tC$W zp&bMmg`lmhx7CdAJJO9PUT$DW=&NViA)o~58{E`_6+Wh zS+B{-Ae9aaH9ynUO5-Y04aF-J_f=gZL!9Dw=djSM{OCO%yiQJyhA}_Hh;HUj@nu-% z`c0o0?g+00?#0I1oL>B5!qrF}7EmKAWj~7twexIudw^Io(PF@2*tx*G=Sg>W1VM84 z56KkI&)iy1v{yS6PsChtRO3)-IF+e zK9`Vrk8j(jtCj_veX~)aTeMpH@;pNZV-esWvC1 zp@2ZK8u%Rw6I-Q+L zsAmah)vh53F!NpkZ0LmEQN{_WvjFmEmZ}mFl^VCxR5h-?Nj!f9^PHuw+1tw3`KW(t z^;k42@NtCkcGKXk@vUh|eU0vdM@+?fn_zcK<6u8qr>wI6hc zlOFs-Q6IXVo0;_AT)?la@FCj%#4cOH0r&WJQLT`v!Rb+(?oKIq@X)(8_4{%3oSi{e zQF|3J9244((Iyd}8Yk|v-uF$>5xj;{*BDhx8>OfGaeD{+$b?-Cf7!C8CtiZ5SEfT1 z(AT-*R;B;J7Y9RH%d}#V`i}#4f4zcbeTnc>(~t(0V47gc*33;)J*i%vv1bWCN?u^t zdI4p5%GN-%`&{zm+XZ$T8}#Hp-!szxESh&TZ=U!{bO(VirL%-X31;`=mt!n@oe#f+ zUY$QNU-B%FR4KJwTX=SWpW6^|SwbFlDUb=%Rk;?+=Zq=K8Xst@(5jpBlP^;7%GxXZ z%1P$jJKxtJSDEr+4WDKSE7|`1%?E8yNOcbaX&K^>TT9Qvt6?Tvi4&S zw@d-2THA9wcNf)9JB|s0^YnkYUy9)@ss+Ty-ITeW(Fdf&^$Bz<0|dqdH_JRSD&`neqE8EkoqFp%FfN z0kN^M_4W0m5B2<58QBDlCys^o(MB>fUr7;lXcx#S&LA;~_tIXQZs#E93 zhT^Y#-%kJNfAE7rcf|j?eQ>k?ZxCUZX34kqZn;E#gJ%D_9hqd-AACB?&V{yTmslwK zfKwyO%BHdfGf~I$j8Rh=Q#MVl-D^W=pmCr|n2{$C(%95wHA!fxmqL>r@v_a$>(|(^ zy5B$)vWi_WhJyO_>ga1Dg;KBjPOo0ENwU z^qB@&hjU!JT11iVes-9b6!Nxh8;Yb-2XVe}eE2b5vl{q*P(Q7irt|06e#-+dB) z>P1MVXvNnZOwAAX3+$;`nWE(0Pd8e|>lzP}+!oWR>*mxmS!kjPiva=y@!jtx3b(f- zo-g|}Pvfmxgqsh?eNhj?ItRMHS=*#e`k>ahl(=b|X$@L?@%@z8?QDOa2gJ;JI6u$z_T5_7zI$WM zIyO5oP3my)>AZJZKMn5Sx@Ea_7tw0$$BuC{YxBvYKUa9lge*KWNRm#&&QB7*-dN+) zd>uEJkL6IU;MpMn8Zt=}6fM=bUs>hHN6p`W`S~dGu~Fk?*=)UE7=>w-8Nt{T2rtjB zkD6Y=0AlJ|YTM6q{5!v^B4kR>@*?WymE$d>w!^cGF%2<&Ws;5kTm??=N387lE{|28 zSX#`=`}jPCjwpN@VQ!|GO(f&Ymvsftv@YAHH>JzU>**WI6h|k=*0r^62NgN>P~;Qy zy)?J=0(g~jNbm?u`FUCozRMqOgNqm|_pu9ZzvTg2^sW>$YAleLRObpIm@cw^zHaDB zfb!}r8xhT)Ypnlck@QWKT)f`JweqrWxivZl@YJzyd3vtF;$Q)Ix{}uOa=>*Hy_r0d z!%^XDtZ4OF?2~cQU9{@(8?qS!fDTd*6Veg zsWrgPdB}&JtTjFc6yS$?S2nQRB9W|53dj>Md2i)lEQ$jLe4tSUpR<$F9v$qjE-u=b zVi|YeVmS8cw_JE9nBP=xef^?fS=rDi2KUqRTQ3c^5%gMA+RZyR|_F_@Ax_YTJV#f4f&t1Y)K0HSh*Ij72FUzSW$tPGB3X)dON2 zCFjhuO^^wT;R?l&{=%+lcPF1v_JzE66DcmUNrY_E1ATLSae+4|{auV!H*W;h9AoS4 zo~N>2R|^flg#FRt8JS2IlZb_>k$5?+goE`ixOG2{9r%B$dWEfolVybV##Z0J)d60 z)}jC{FL!Y$dN1+o>@2zuT^7yHGrSAwWN!r?kOjt*I9|$OV8v40Y8l7MX9(GCmPK75 zSzgxE0h`vEo&a4qtk`p>zE|Hy>`xVjc&>R+9(|slmPKZ-sLsf}fiIgySI+E^MICv! z`j4z-F7)7?f-2PGhN;WS1JGBMWBO`+h# z;SoQ;^iWd)Up$>EAxze&qgQ8SoHkWv?2`Pm3~O!en2hal6}b2j)lFW-1wHVoM{%71 zz~6=t5#{p_-hasiX|*|Tr{M3(VF5G?|{I;7R(T37*W5xU>3k}zTg-X~PzPb_87 zm$vuC6$K8*4Pg_`mmCAFez^OXhguFKan2A2c=<`;y)T(Xzyx%$EVjbiyEDOfB}dM~ zy4=wHRowNx1=ggVgu>ZnSjgMO-)(Kn+)7(47f-AnXQxNfWE_W5wayp30Fb5)*uNie(twUWS7(v@B--FmPBggUD&Vr->F<-WGrJ%Ktnun@ zmz770)@PBN<3gkcGqWVSj=fb;BZ3~H-_F_%TEI!da(uEnI(lKxVGpg#464RHvfbxv zV=H8$%T=?((>et_$qpQ9wJ_haWvqAu?MAiYpCc(HVDzjnH?3yz^U^uMTe)v)Jvd$Z z`YW2scCXLC5bWnJ!wR*R{7heTf@DoBj6!SoUJT*eN+xQ|K1qBjva1~7?Cu5 zYP~4+F3C1JB1_QY5SGw2QCd2kN(=Jfc707=0~0t@FE=r?_h~k6f(>mT=cdIDU@7g@ z2o4pm&VZ3)rK4*rgu^_>d#a-XBg6TR549KYeV!9U8!GW6nN^6Se|D`rDQ?i_%J-wNkfl<8eZG2n4f-Z3Xpl$sB`dW`;q{V5b=`RoD8~DOt^66Z zBJz6_L-=QCRoU^mG2^~esuXL)!40s&c2{9?rj44e9|IXNIN%^E=`6GL!@^s}pqXJA z)_jlPF#KXud#rWA2mpc|biNMMWLrsO|7w93O$be#EMpSMeKOJFu0{-uI(=CayYpF5 z%UG!B2R(;UkXtvpB-&0SfjA}&$&p}yFVK9~UR1&2@bp(drI!6b6&zlgGCwc2`G|Zc z6Mh$_GY>3r+{Hsy8dKXRa{#oeZwH3r+T5cjB3Im@>_Xu)P_K>E8Jx7PT}$$^8S7>? zOjJN^=44d~n@Q%UJHy_cepR70o2ygIuk8F=%V^I^LiBUQXEjM&{r=j7z6>iw2Wo#V zo3GB$HRimo9niilH-`qYY&Lxp1vRf5dMsVkrMbb7t66c6;`UzhtUDa2-mvFWt=NEk zkk0WLWwGMZZwvH$b;(w#%tglnjDmnm7=x&x)E8%cI=Q(H+V zDafD*g14fOtPJBbR<9!2#W1MkaA_I+oo+1$q<2944p{ZQ7zb!7SVR%MYw8~5mam>M z%E6+rl~@qnJDqFtsEg@KE+F6X;rsAONu6OP$yoeN?CALN#Du7T;bm%_8PGw>YxsGq zdGE;GfpwFh5YIwuStm$^2qi#CnS&jgs=PrP>ft_bgH2&)>-dU}h%G$3zT-WQz{Io| zo=~WvAdOT}S!*mv`UUrgGdk<3zHQPpatBGzxhx~Eo9mbOu5Q+-9l+?Z(JbeIyyGER z?e!D4U@F_)8s=mYf@(yVqyItcxN<->SWyF*(^|cm(kYK==eTQizFSh7>SNdyKm*Gh zv!$xN#I7BemO+Z?NK7cDn;1RLu6wY_|B#g4Q*W7}TOY?QuV+f-oRUnPUng7NstEJ(&p%|Fz)#Cu|tq#b9Y=V*7QL zZL~^Cv5Q)&xfER~{ch1%du5VT^QiT%<3hl%fFuv#sMfFVb;V@}k-f;I&u#obuH%DB zc-&)UnQXfaVyPm*^zJusB4U`skR{ALS78%1nRHM=Bzn-b{p4ai+^3l4J}yxHra~gy z{ausJ*w=0SXXpu)i&Mu>VPALkE$EfEoblJWYUu(4&Duf{y(OIoDpf1rLCcGYzV^c+ zsz}Dw>hps`pxdtUsGzlgQMf(qZ-Wc5vm~jN`!( ztS@PUL22}3KWN7V=oVP`7t%$8-A-3Cw z>#G>^(~K8tnKD}f+ixTaueaDQQmy~4aKE#lx^i~#yq3H%i-|fzKOjUmSEZsMMnEc? z!d~J1+9(n3NUw@Lk@BCF|Kk)13)wI~Uhnf0x|lYR2|Vkxb+an(Y69Al$Q zP3#COGAqNIB5vvIQFPq)#JhkIWb%c4G9e-9x#EDnj5B5N_V4!EVRg3YE>?HK*=6wO zg|6wr?8@Tg_XI*-m^`9AxLPenbcKkfg^g*`=JlzM`(LD`Nn8vNS=an{79YNbr@G<_ zNWW@Nju!ANXC5&romJgPu67i@OUb6)e)UW}M2t+1eywqE2xrZj5nQNX;j-rX>h*c_ z_XsyAuq!LAB%e~Tk~9(SxM212j(>X zB;z1q&o${|fhwy>W_sG^uw?Z_B{`gmj_>(M8K)0T8s^oz6AARR?6slF<$yUDck<+H zaM;*gqPv&X{E?cY8Do8fFp(5dII(=s{{18#M8Al)SU%-Y{3$+;d4FAm=Rth><>9`f zxjD;jD$d7Zb+4HGMN(~^VbDYDSRz92m$|rH)nkVwd(noN z-aAu8CJ&q4MW-d`71xp&Wz3nq61pdw*FFh{)=pxv>20tYXG*5z)wu&GIx$HH6gK5R zEtZ}cm(9!=tEZ@Nwx?7uHNIX2kvt5#n*7!E=^wVFe&VvnNwl|7773Y9;B-j~!$gYm zOp5deu=C-`(8V>!&HNU$ud%|k#LG*zaiGQ(CB@3y!{P!fS56n0o(uS3ZeBYMv^GYz zs6x)h$`c~k-p8~BscC;7BN-g0^=Y5?bIN--CMb!?px0Q7IN2;3FRD-#*w+8(SlLu) z1Mk>ofwE*}ROIA8c>ZLW%_vumq$ano8UFFqzxXZVc;>gZfJBB5(Q+!6q6IY8b9Mbj z5LzXp_HSW)*Kaj!c5Io+HVat{zCgu!hc%?D8GIb(@h*1m1yK{v8LJzC#s^&^xHZ@Y z^QA+DBJpV|G1P8jnR+eX9cZPi7`x;9#Z?&61+h=3e;pOOxOlTFSmZ{2SC|bqk*^Z8 zS~@4h(lgYJO#uZgY!+FqUeUoEPnqtMI8R^LytXs`P%v${jaP;x-1uQrm#KDXzS3 z=1+TpN5U_K7UXG)zU58G1kC<()=iK*Z!I%AzhzUe*3~;_{MCt$MEFKnjs(da%f{*v zF4wgZrTM)KCz~YaK-0c`G-BO7qJKJ%i->UB`q-H2F|z#yx0O8khOCII;2 z-u9N3f7{pIY(yCPS(W#8vYZup!qZ;wUSTwapVsOpz+qiGpGyKjsCy3C!zP;6eS1c~ zN@Q|~CfKb@$p<72G`9+|h2dKVRo9BFu|~M6RNF>sGnnV?o&8Q!W*Kl9Vu8G`@N{UJ zS{D4}^fmV|H>}Y!8bFv{sgf^PGU6aeIB1J=9M-vq^(5n`7yYkb!2691dYJ!5M=Nd0B>KW;ey;*LUZt zzh=6t!ssD}N~)!eu&-AFRL+{-$7!`P(E|;6dF=!uBaFzBBb=Wu8{hM2uXucKDDuN zI5dB4p!8gp=YC#+6@L{chelNjP(40=W|hs@=XD_n1_89-Ru;1xxpy$!fSr@JDzt?Kc(+A@%;;OlO-1GdJ&E4dV{x+%RNz*^p0wh{P2mrTWU} zc#G-ONL1J28rBrh)50F8q5+stKps~EL>AfDeLNsKj&p9b2Q=0c9O;rXB7!$$sZDm6 z)>RbQh1N`(#;0`|;l=#crf*FjM(!fq36V$a>(r0xMS6g)o1o6LrNN?PEjA5?+2wzT zoxVZu@+Iqsbfrhz@4wbYBdb`+PH%dAUms+M=-{gyYYrKRxO%0<4q zU6UI4xl4Y94^mO*{Cv8m;+$O+X`}3WoD8ZAXOyyvss{5LP{Mhsb8L)XyHk%E``rxF z7pSF3gq5%MVRiiRtuW4`FRowyOPs3ztC9Kt7q|K^cl-bNp2LFJ zc!H&!k6KYx`WhMO=^!qWe??2(J&yGrU@(QS%Oy_0<%4wYTYyR=`G|l+)4japb$=x1 z{Z>_g-|1Ynxms}o`f`tq?BnC(U0hwYw6u^&a{t?PYDdKNV*ua304oY~MTC~>@N}&B z1zBd6?UCz+g|feBr}n}hm6eX?dl61TDjc=4w!+O1_f<#p(5i}x=zs4g;?_UF z%j+ul17?3PjHzmZiGzcbf`abvcga7#etrBONmenxtLtejrKsHB;~W~9nVDBt!T&c? z$_}l4`5&efal;ztUy;&(xaR-I&-efJWw7%AdJZ^esl^v+P{e{oeSLZHh4#L%%FUhe zr<^MZ^?lGZ=!@^FhV_UZ|+3M^MI$;J?n206OHSLg zpz{-IE^JN-r@lWl6sah=Y$|jQ{P!-K@N?{BJu{ugFV&R%*Y@ z3pk}8Dh~2$-#>k(LU6%ks^$#M~)5w+Fz|Xo%)ak2(C_;74&NIj1t1bRa|Ka?qeenSl%S1rv-m?EyF{(ni z;#HE`E%9v^GN76M1H&Z98;nWWa5x|Bma7R98;vzViLviZISwamdZCEbZ!d-^&rbgm zn#Pk_^h+$SBW?nY1tiy&aZGPI+27pu-S85n$b2#bBSSsw5YuSU+K9{QHgz_o61q!$*P$%N}KAR z3*}{PcY#%^%7Ef?%;%yj-X|qEY_$ZYH{-M`mmTXXKc?_}?nbk{3oYMUrg)fey98$G zi;zj&|5?8#YG#0*6oDjB>+GqMAJoQ{HCChy3F}fJsbs2K1HMls58_{5EBjkgIrv$4 zdw2{jCo_*Wd7CpVy5t1LrAHoJ9)75Eo2ZFO_rJLHs2Z8VE6O+5H)*V1aB}ffT^3hw zyI8uLzIv|S`!yscN4V{x8O;=MHRS1QOh!-h)x2Zb{TZW2H<)OmP$=~q%qs>qtI1?4 z_WmkF;)4>kp<$*X6fhV{?Uto3Kx^L{Am;R-Oqs?$+IkNyt4qD|dOqKA)ua{JN&OIv zZaVtkT)=H=+eVv{{7g}m<@gFawb=QPVdg94_t4=%UI*>ouK{hXJ@_{&NgfZ>_qPb3 z!*LU^bJ4F;>nM|4VrgttmpDCAZ)+P$Z}p3(eCeZ6YBndUz~ubdw1@sTx&RmrTGVm7 zOzn7{D0Z?yeKf+eF>Z05Yd@^YYMTZm&uV)3D(N0SwCI1eus&Vg{D|L65Ha##^Kco* zi3Y}V^*7ulSKT%&e7u9OUx}I+DWEMeTxh1sG~n)hmeUZ%#>^bv4sa34?2V!H+0OI; zA1)~dJ^O7haDis`tJk(ay8+)9-si@b@m9fYHy_`m`3is9tDiw-nm+sKaRCscV>iyQj4IIXtjpGP9 zfSV2TcI@&NK0pRv8wfw3|tsg z|BJ$NlkwrAPknhW1*xH~e$?^i)k?1qzQcKqhkuK?e5kRZ%VZLs!AE6fzoU%k@O@jT z73nMLsj!|5+f@()uZ4vg*zUQlStN{xtVWY>{D>!irJ72jEYlVJ(m1&JQpf+fSaKcZ z=i_^qnn`W|s=dha-eb-lMP(lOhQ4_IYd%%@P0QUUOo!(F;yatJnwyG{-;L1JmJPen zmaD_Xqmu`dfGc@&Vt=2e-U(c6`m6ef)$nWy)DTXks5?H<$|P!C-jQcgu6eudYU+(B zx6xf-?-4Vc3-nBMUXJKYUty+6^z-SaD^YdT{ZDa`m!Eua+|IyMXgI5zy-)8U9NI72 z0Y`u+%`W$@dwAP!ckxH>_H*MCT+iL$=icH0)`0VbfcsNr&WEe+qmz|+5s-2d6LK zO+o+LF|s=hPoD9~;DDN}O^w)fUhOXjkb6VH`k>6i#fG3T7!aR`MkG$`3 zo66pdzU;WKzdu-fICiF{9W963X3p0%clejeWCnPjjey`Xj3xc1fK*PX+x}%NXc^U7 zpKqK*{1e^Qk+=d`)dsJujA;-4fOI|G8kQmXw-IPAKR=~$t2cjRP#+KI<{&**FFs~P z(&=FoC&v%HzDua1ou6fK)KcK`&?_cp=3U8$Q%O+6?+_@N-DsA$rR89Ma0up;5g9c9 z&#qo)tBUP6HO3{+ikuYv{(clsH25_sb^)xmp&~e}~#BtqKF;PUU|8o9x{ejET*LU-J*lnr%g>}bo z52_#Dq3H8G@@057Td{l2<>%L$p)bOb6cyRM?(8d(e;g@8LlYAMeT!}39GAl+6Oi+O zeeyf%J5B6=K%2Kg9-{!Z&^RH-4B8AKHM$u8zHwh7`A*X8A?aGI=&|g^7o@TOQc9J> z9(9ru6TcaMh>%%x#+6_DRjqETABj<8Bk?K{n3-Oi{~wo747yDW~1#v(=^8CPi;MFd8Pm@sM3S5@jG7zS7KY&N@Kk& z2FdeIqhNrJR;#99K3CplEkv-wfb1c)QcmM`LPxMdB{KW?7^A!rnwqF>>ic2XrIY?# zLe9&;cGz8bLDry%*WQ*lRJVxD)Nk-y@c#6AZIENX^3T;F!uq$pZm+Df5#c-MUndha zHFV5hgYkibq^f4?6b=IT`1c`Dt?bDqIiVPkSfoJuaqNrluJn!Nm!;991wKcN%?`K9 zdW6iIvz({XeiM$SfAI6N*}V*|_6QGqDiA}$L?0cEpiMF}jXv8y1J>~4U}o-?MRmWa z;VtZh$}~@XR%~Gymz;DV-&m_mi)yGU7yXx5$F9S28Ncw$uFW8BD1JjJAx`kG_x{x& z=j2#(N<^!PN7#(yRaBT;vZ>c*1T%>9>|)=4`vL0%T0 ziR~_0!Dd>MFs^g802;Q`4f)%YHd4qqBM)ducAt+c(*6%?&maO*QXaJW+A4 zYDG9iXdorN-4k8mD?(sh3UcfY4?^`ru+it6a1%rZo*|Q=O;M_AC;@tCv0H2Mnd^m zQ3CO}8fT8shK6Hib-VZ-2kTl_t*#XZ0sqG$d^)>>Lk=+}v&5g;EQ}E`3UvTt$$jcb z|96^<)}_9Fx}3%IaUb8so2kVwhU^M!=PAxc-sO(&*xxt)zRjkRR3jos?uCzRKwD=n z0BI8G8O~%e=+;;R7MYqGFP-zA1sYJ`m7RYs`M=tG%b+&Dw(Yn7I$oqe(c;D3t+)h2 zafhP8f(1{33Q*h~LW&o6*Wzx$A-KD{?DW2$XZF0$%xio0{_@VAe8^nuN-kN~lH^?H z@jK$Mg4PsX%8Ybgwfk&v|Mpy7A>MTgFnCV|T4jLhdFNMJbZXMA<31j2R0we^#FYn5 zZP$(ThNj*>@E#n_p8604$^OrmvY*~ReZ(qR?I(leYH<|Sysr)Y9{~~=kcgzV%n&-L~X-p6Rn`ei-&-m3yH@{ zDL)h}ru?&Ry#!q*81EU@A%DaNh}IOXivzgwWkwSRX$Un`TyRH&$gXhw7MZG7q!#?_ zSy334mbe_Wq?iTpxzV&rjgjHt&*aU8j#=D%q^1F^hE{^06svlw2Ahj)-!OkZ5!Wd| z1C0sS3?n;{*Ys5Lk^t|qb>Y#vI>=QwuG4cHZ4AZHNH5F&*-}kltsZRE8%7PcaFiBV z#f$ZW#Yf5O)+<==FDJ;ye&%Cr`axI^wyl$IwXm2-(z`AVi=)pX7EGAPRUazkRBhxe z5Mggm&7u~A8tVhv9nXTbvXq!V6e#ik&Zf0;m|GYD;{aT&{WV`$%laoi2ks#e)9dR5 z6$BnTl@r!4I^*8GOC1VRtFtK%x~CvxFaD z?^riH+qXqk@DN9j4oyr_%He+^y;tb)eBEuxnVr`$fZQ+~+mUV^J#LjIE zWofWFI@9UcAjxbJUMbK13}@}vm&DEA>Nv)@MoVdV2_0By!y1G;>0(kcBo*hIV$OYU z6qBl(!YJIW)UpSmB(JW+!W{$(6}FHITk=eXRc&*XRdWSmO@1y=W+rBSh7W@L$j%Fj zT&zflLpy_i(~oYU!HpBzdi*pm$NMu@@C_S6tdLDdaZZQdAYr*??;b8oZ}Nc5tq@I& zW2k7Du!P__xz|)zI=!3dw3cNQt{VnAbya<_EF(!d98n|#7mYPWBlz~zC5;MHQbC`B z>_T;l)Ng@jxK)f2v#U6xgKC7tP8F5<5L4F=nHaX2b47|w*wZN~o1(>O)j8BVg;>n4 zFeu5bRNtPawx&YFv9b&GYCf;$pLlP%K+l_?_WDvq9rJmQ)=ejmD}d8aVS^wa>(PF3pgHVLNVHt*7*$NkAgDX>uaakuKv*z(ClARjRmuH|@W2S6j zfsQ1T3$G$`1J*U>B9ocR&7T!14@FAHs3sMZEvJeybh zEUz(Bh%%)!oxp>M2zbqt_lJ?~I=@;ye>vFmdBL_+n)W=^F@dJ zp&Y3ixrC#*aS$bA7L`xX%VXaVb?wshM%v-I5sD@La$4)dNfj?cwbgu0nYaV*^Y%in z>{@!cS$9V{h5}|*_I%c(Cg1T+c;>jGZ+n^$DcCt7R{`j1J9ZGdbHXwPJ%YV#nKjVR z)muWkkLUE|vngKGc%KAFMJq&*I4`!Io%qeS$A9v)EN?s%2n#|>>P2^N`GK;r)P8Ul z>qjddDO4BOL(B2&k#FJF1&MhFbx_%Yq-fgn20b(O_=go6-%oRW=x#q)@)v_lS9@vR#QGQB14ek%&wu9Ec!r`yZQ@I!oTv6{E)(ETkmGpaDsUBx< z%jLRLu_!vFZh!}y|I64~{0?e$L~Ffn(ZOkk#Yk7nS(06fAJgAQL9J(W13P4bx}^#N z#gKBbj+2pDXPaW%we!u<6S1k((-E;@NR4mVZ`|^R`@t7VHvS_wt z;fa_zw4N>cCcm)W!Vb1s%T1M|@2)11ujWnFC-NI53w9$zLiiIjQWWM;p{La5#ztDI zF)7PMPAC!^K2WF`GH(jg8;E+|q$sok80)>q?qXLd?gL!7A3TJ_p#_hl1^c^BmKKY> zN(UL_{cwBUA7)AJR5jbyL4YJk5x>rY$AMyt@|n);9Ll0}wfcH0_mwjmM6!9*87Q;# zzsrO96p&49v-U88lmrpa&H=nWb@cvzd@?LJkHGeUfq_w{4_BG&1~PzAMzTDr%j+<9 z2L=YDH21%W68++xS9=^2zkKx6jnWI8l*`8uI(}Gix@+~x$jljshw?XsxgsCql&k1= zc2lvXqHvw@pWxFoR|*;s!pr?+L~%-Wwoex|;;b({1!~L3NB$!4w5WehQuwO2P>mc3 ze5&B38R;}Ck()Xq)A!sp%j8mc@=cRk{t&k=>CgLF-H3vUBF2XPcZ%G{`aa(kD1riA z6`Z5=`y4I?#jL$%2JnBjb}&}fKj+*%lda)&lC<~nAt|e(0J{gd^gDC)pJavY|2PQT zDWbak-V^&mO9qdM(<~j|+$K3z zCS_hDary~~#_UsR8fB-oX_Dv*pY~o3GJ4G>V6&-)LT7c@n!1T^Q+&|=Udzq_t1BCc9ggb zDKQy&Glvv=E-1_M9Dg2$>u}zSIpP-g+7`&ytubD%Dk|MxGFvj2Fi$WT+*FNdpleTS zj`|cWn8fx5Ou-Fk@}|kPM>`eLnDfvd}!t%vN0=B(jlmcX^5Li%)LHq-y4YIsVEv8F{-@8woej;nM$>Ye3XNKQ=SDdJ<8`BIji- zfjQdKU&ng?tW0R*uDv?~r~dArmV(@hDOnuPlXs+tGg_-_HY>Io#qp;J9iwAF%E$}A z1-9=F=-I$gls!}$5K%zJnx&sihU8f5qMQBIzOyDD_|BfPl9Q!h=Qc&?f^F^yMNT5VcfY@> z)G>4h0uG;u5;=*b&}2=X`2I92=6Z#E7S_Gh=X_r2s-J!1GLe^`!&;n#t_}H%R`N-x zx(x)_@F^`yZFM|VGyATXGs)n{mNI2wwk}&`P&C2#>>z2IdZp}4Z!0O;3`q!&b+}5` z>^uBk1jas0v@JcJmalYon7ZS2HAX~rQQp#dnF}R;Q4d z-wCu#!))@7KD$dtxeK2;mUe2m$ig0TQJ5K_J=|;sN=oF*Y$5NAjzeM!VOOKz(g6+{ zMXr1c(`<>7GhuSGglYWm#z!qh?~WtL$}A_?^rJb5=Y*uWvUyfcpPPBUUptlUu*nNN zTuEE1aiQQQ0)cC*r3v>D)`?ZF=B7JT;zTKLh%iU#xvlLo{)}|U5}3D3=SM1ZoRw}| zzLdnLy!mcAi?7(|7gB2H7!OM%R4e9-{bCL2U1Lc9r!JP=vvm{Ba%~3{U#!?x=1!TQ z0ai$Ci1B5M2OrLm9f8&@EPC1)guJOvS^A}J80e^1|%s7#PYoS<`mjqIZwihTaQ}B0uV5G%akTCe7@d z1=X#YSo`{UXgh$SKK%yW1%iZr7@pqgL1a4?3g0E^sqy>SqM6ruUKn`}m-kvr?|EnB zrL1G-E<$A0rD#3Mxwan_uK8aNsamr2crox{)noW|DAu`T*hW!Qtutl!89<8aES<*| z9;_M#G}He{Vb=IPMHj@=A-rPoj1NbFpO#p&GJQp-GQ~=<&dLkKAjGuw*r7HX&yYb{ z?px0Ez4@aHajSb*y z;1|^GI#UtWOEqeHjZB&DZ3;R?=vc+e@&Bl+S6V*32F(P*5|b zgb(J#LwDLvA~1WbT!*|2;)d#TB!R-rfJr*1%An%h2+g>YlqQia=Ub4V(`y>I@;ro) z8ZS>RD%Pft?Wl&l>?f^r-G@E$W978`#!LzzK0AJpKz4NLkgD$PUMIqUw1dzo^7uXG~&8aDtndb{ICq37@;HraT z570#ef|uHoxQx7Y_2>lwE-cRWZEUk1mP5=+;pDu6_3#j0Ca;fcP>C$`Dgjg2L#RTa zU~|L6m3>fh%d?u_BP%w}kX)dEDWj;W483ps>7VfRhE1z>r49;j%Lq#%!F!$o_i^iW zT7uUBG%l10$3IRQ3Y37au&y^7UjOnpM=}W2P@+2YdAfW-2HocH7L`vxzHW(yK#4^w zXh?~h^jr;;Yil>_UU=@;QcgYN?Ge6!7Gy7D5@2_9G%1^qqPbpFy!MQY)tA<5bPp!7 zKl02e@WV9}0+g-R#Tek%gp<%MiIh7mRt{lP!|Q=Ev!Q(!Ot!ntUJX<1yi*@rF|*Tqul5FSw`b|>%{`b z?a`ir1>rGT=o=r4<2lEU!8D<4x#_Qq+@Bs5PLEQR$xR;YYRwhGH4Zi-ZthCTSs*#V zwR4Rip8>x`pR0?kEiZyz0+$%5GnZEov3MO?SA15eiSQs*$0xRpxnvqdfnV@ZT(5nOoUFX-oZwz&F6OP^>Q`XQby_u6uw!4%vbS0FAI+NU!tStnmkRVQ( z4S~vN1aSS-1UdOt1fhhZeE_6{Wy}$-)Zp{(mcp)0#-;<@XPtO?c9U1WhYBZF(aNzL zUvM8p%B6yaV(~%Z;-vN)K{Rd*E1TdxQIMa3^-8*))a@T3)uXceDz3&le z{<-#ectybe7I&sSNd2}9apwzBu?)T=!zYzcHfF(PbC@C)GddTWIum>U2PTc%mt>7te$FFP`WE@IJE z*aY=6->@(s+<%MLTlI2(o18=KVZlh4n{Y!|LAeYl>O~z9n8D!e!-Vm>YbIW?SA46T zy?J;S%L&(hb_`*A7dT}P@qAY4z&T4phVQ7GdQv%NQU7aVB@`*G!aQ|Q>Nyh`doh-8 z0ZCH@>A%5iLKF863O{6=KmZrE0-W&n6(NiXglio(%Cx!X-BZo-u&9_ACkh9{XUfH4uXy?tA?sv*Z&*N-E%mx|kjc%Bn zlyYGRl9%xn=vxComjQ&;y_0hen;itP@G(If%mwh)Y6je&;lILtAN2vqk{?eFj>gKoRyiyK*e(ciePgfXUf!jZVf9Y$n5&=`u_F65{Ex1aHy-fSUvvoRn z=k+DkXav5hY;6L46!_bzXkIErv|$)VfbA7%jA#G)1#Ba_Bxs= z2dCHGKJ`*v2cy@OO=ao7YACI}YClx~SwH)$uu4UzR{xcSUWNgMiza@Eh zX!kzY(JM0!H+S%0Z<)G^k%v<8MFHKWtX2Fb$nO*zuRsK-*0;y+Fne zhw18F+Vtn!6yrir{L_nIh8=JPreSg9P*EaTCS+uTUr(N55^{e3+3w- z8gJ@*K0~wsuP~=YuE8M5OO+-U>$N>dGlN~ zRWf@N@$(YqQ*NMd0XVjXFOS>~AsP)A`DBjjVs#y^~5VTZ}|)IwX|GI6pigCcNl z>3X-VWmm*V!0x|1!(*5<#su7to;Hn`&O6lHmUAUoM*pg^oxI{b5FM?*m)_e197Me6 z%+o+yleD!Fs`om#abE6OKXDMbK8v=vHsZT77Qe1p$dp@IdEU$?J53V57jpUDZEvL}W; zFzpL_?R69?=vsczj{*lyW0MP>+vqk=zvxXXes^dV(p=ByFY3H@XCw*5u2Piy54R5S zH}CO692)ik3C2cDstmN2M7?o$yc^z&*V+JMhp8x<$EzhnY~Md{$*|%rx)ZbKI&5Dx?+(R6Ep=OVTh~U}?KK@Q0Oz6!e5A4RW ztAzW-zH*qGvsW3Z3j0N^L)JYd&Dt2%mLt9D2Q7n!GCSP>qfB&&(*p;H9K$%iS;K;( zTp^%#-qPy$+wVZ_Mcyq$dorLPzvuH-FY)3C{Ek zwd5rk>Tq(R;G@M2+WP4}A3HO;aJ^ycOF`KZ`>?_IcX?g{jV(0~&$Yhs?lR({d^zw# z_^^$6>hs)3m~xVi^j7!k>b!uU4KBl5g0ZqL1K?j!gku!GfdDBf`Tg)_T1ZT4Cn>nA zoodoM+~L;?)ZRA)%SZ^{P+4ZC`El>LOlK!^ycKnPfICT1!qTn(aI$=gnucMlrG^LT ze(hM<7(*;}UHyA`h``z(({9gO-u8ciHic$yM9KGQ?kuS%p{a z^0MBm?Wq99}m+X3A8c4pJj= zZfG18U!zLEg%5_z{`2Hb7RomigsgXc&X!tG(wscWgd4za-k&6&QgzdnLCeWG?_}07 zR=G+OB2e_JmaF|2y%+$b?p;Ikk+e5dcir>d2JPG9ncG=Cl7J@Z6ixl;)Q`~)DAKWr z=;0xRpt#S8@4(tZfLd)st5~sS@75|3z-(;DcJ4*TR22&r9^rUD_?u-2pb{y2C9Xa_ zwz_T=VI!d`kPX$qoC7SA@CI=?>+ z7}UIIcc7#~S(ma1yC0zP#jbCrS{_j5uHmho(5>{J!~uB)1vG6({+J*#M8hU|dA`NCCfcK1xMw`xrufK9>AnRx_p!_&4A76+zwiNG~AAdgo^hsxrrnoxFl$%|C>N zbPcUNRl(m5?=#tM>bNAxt*7t9d1E6rRbilVKI{lqbC#;H#nRj%z9KB8tfAkG+;a7# z3j%+VLi!5&XNsWp?uXNW;(=5C1Hq1?&SJx)`I?d_wx?0QBV6i_e%d{G;WXF8DlRCBZEIj&S{k%k zib0E{ft{`IcQJxB6*-T`g39e2sm+gz+{*JH1|vGT0r8C4xNwFGL822+8q=z?5U*1z zlzAN(MDPuO(e^Hk;o<9PPqX(=19g;Z<(4*~WzS0-2e3<>uI9py;^{VxEH%$JmPHHMImKzoIY6VKKOdr$V85Jom zIaK)?#7oGkDPO3HatCNVp3z_p*OA()MrByPdC8ObW^zGPlIxUoxww?0F@v&)dkRC_RZV(&Q(HMwq(2J*$P5$$psc-;}TqMpb){sz|JBgtz zDS{G&H669TR&FK)MbDnv-=s!J5!hDLn)kl5Y<|6ShG}Ttu_AIR%ra!dqQ_LA4~via z7*p5r83;JiWnJ+1;|^kD&29bN!H053E)5)UmX*IkTy!;g(rH%tqm4x_u9ms*A6k%s z@Am>UtG319i<_6Xl4X`797FYIKnpMS0s> zI}`trF#mt2v#~Lurj7qs{j~oJ@>H>8YR--i#T%tdb#<%W+}QZ*A@&uZVPs?^Cnv1? z9IyO!IGJE{a~Wwzg(v{n`6(fT=%yoFYm?P+Y&m^smW}@n$VXg^3v;7*0c! ztiz-ki4jKVVr6yo?G?q%)oR4Q)d1^xxoJ1&CBCBwgfiiu3_tGthTBAGYSi#aDJ}Ld zZ|h!!iunDXSBLhC&2cQ@o#>$PGBX$%(KP~YbbfoUS2VeKI!gI(@q=v1R6<-_kx|nP zf6Mh?iO+f43LSU3{AH@L%-nGE%|yvtqJ)i2B4W&!|GL1kvKc#a@_p1DJfaMgS-ZR~ z)mgp%Ex_hyH(nqx=7V3#exP&;OG)8Cg3tMD@2LJ!yM`8nynW zn4)F@7u&x@um8IOn!h@t|7Nd;qH#a!i%%4!B{crauK(#~pdU({kz@ef&tcVXj!j9) zog(caN^3Vc+}rcmE#j|nSaj2($tjrFCUMO$peG7JGZ2}UH;=`-fQm>hlvR*$vVu;d zvv;GT0kOxuYtc)Tq)y>vVoqN+KVL%4M>|meDp51r#)ZSprhVSu=hHR`SOfb)e8? z>)I_h{swHB%2ua1@i|%uK5p6yz{d(CRanTs%hI3-I{3hcAKT9LS^sf<>;8Cl)DN_$ zkj(Q6i~hk=oC=N1>eTfn#rHZWvH3R1;9YwncL|*_W=Lh0$9q)PGqA4C6XkUJd}DHS zG!1Ud@yHS6JY&TnzZA{U_i`H@=9~E3o8sD3CyP!7HKHcQ7&)}!KRJa6kiBewm-aa> zq|@W+QZ#O$Gy%wKS}X4+Lu9;B9uWMW^1Xiz!v7=0_Zz$@`tuV~=89;-<1H2dt6meM zxPqc@EUjjto*|5dCV@WcZVK?1j@+}7#D&phaJwAsN9tr`Xg+3sehHVqmYvBq81;yI z`J^=?Dw{y7FfCN<&l5A!196eHGpEzgHkqeJ467JX74%~ph3smVd^Ik^!aqV(=Y?RX zX;F;Al;q!wSAq|-i%7>K-H3tl0gSZbY7H;KDxs;=9CLv zI{?R<+sdvT8ZJH%te%hAQ)ys+u!X>S*YCggg z;4L;gLWi(iUt{66T9sKYQ{7z-Us!%Zv_HvWn82myTRPRtSgy!EjDd|699E5>hX*O=D#r}cdw5S#>QY5UtXyBtqsdI29cK&JmTPDAJ-ndLF<(oH4z+oK zcKh(Shjg$bTZg?m0$HM7pvN%xDQw-;4&bG!Z~`%2+c#5Hwr`oT)H;KC+uO1E+8=X6 ze#v>Lo@NlifU!htGT(?kq-uNzqO*U8X89{(sg=rvSX({KvL)%>juu~H3FmG|yXO~v z%&n+?R*gSr{R2^UdfyY=xC`RH-LvO1e)Jg@Nud;k?1fgY+1T)E$nji|<(?DUX-5Ly zFdH(8(nM$n%%`oEJ2JwddXSYbmATaT25dDRa$AQ)?t61J`x1#6}sMz3!&hkgZFDkIMkF+rgPl$*m#BE#ZHLyi+^4!s7r?MOm<~ zdGO3T+-TW#g}izG;~lLD3f?v|u|;08Y6lYdCPnT|#3o7C?trNtW^ z&XyRV85$RJm&gIhvI7>9obar8hd{BD&%eR%iipDgEcTZ?)HBtYJ>3(X+o>+PWI*PV zmJMHSruk;NHI2NtTcl_b?hG!3k+V>Kk$P~9^>~94!nTI}K@WOM6+qC<&Jk6$zpM4T z{TTz$Xsqt0YoeyAgo*)Z0pc4?{JawXnI7S;XM$gFsMll(zRrxWz_V4VLO+o^0Bh>K z>8u6M^&K@ZTv>ya^*#qVvvGeZv^!a0wN=j(ers`%fy|Im#T8#Hj!PqB+$t>1Wt%S| zZ6JVl#cb!4uo_sG&|=}bX&aiWj1%|S;Re-!4nrImDDt} ziuU3yf-D=_(hXhHD^^|eNco9^H^?&O*xX68l8D@7GNA)s+$ZQUr~X7y)y;~p`w!;# znXr~}xAG+@_f`W4pbUV^#EXpU*F_vtX{Jm`cf#+WdiV&J`H;O>X1v|q`bSo2u|Dxz z?zqaJ2nQ9B&QLL^e2D#Xnh>R)))wXpORIHw~ryL zrN>=<0LE$p#lKM2Evolj5!M&~RA`rv<5oWIUY*)o>xm_vJbrG96w1(E;mNasr}1YoMZN5UhvOJ8kl4{oJo|}`inDj@ zd573Tsl8OxsYI9ReDPm{o;<;@b{TzTD2q^ERH7 z*rRrUWK1&Pkn^2bpKqMWMFPXCSi6)@RoU8fQo@!PD(oSy8s}7lTbfk`6nTQd+rfTr z=mr%IEAuK12}X&o`W3_3z3hA8ugQHD*T!9h4uIwl-Je?oP!q@AD7W{ETv z4Y~rIE`lDh#f~RL1%8+$(^XFaxjz1#c|I8z3qokd!8IjyO;p}?8a4B~=c72`@WzY? z&-I5V7jfc~S%@Y|1!lZ54_eQ;zVX>8l?73{K^+BYjNZZBlyrB%NrrQG-o1nm>T0fzF_Y{ZoTcMPaHGFE>xFuDYdM z4R@tw(oDa5w(!N*oO)w+f@|-7YT>6!D!pfR35egx#st0jFJ(WwSUkKDT=o70HHlR+ zIXt})CA}Um`m!0`Qyt!h!9Im&K&S1qeckx#Hj(?YIN_78q#Z12q@%mqd|mJ6J`wx~ zqLuPJe`!{&70U$z`Z}(7ELtbM#W%Us2G6A>uTDo2^JK@s!#3U`>0LNFD$L8AY5VCh z5qA?*A@&SRs<_v5^5!#j?dOkg zzbH`F6*n#0HLPiQZ}om5y0~6Bm1&~w4^Xa}JgA(+d24y4I^cp4Wt0yYl7RQxGGEs zlj9SYa;>!ji;QLx*Gi6C%!|e9gyLRbZ|nWwp`QeHX@E@|eDQz;^upBD#rjIWjeh&T z=5q!BB#)wGY=7rxk=tt^6Cly=( zin@q^3wztW2I!|yA|qF|B7f*74NFk zxANda%w^mMXGn}r3yW5T-BG87>#*O|&u4crrpRy7@6$Ce8LRa4#wfkmm_o%J4iX-5 zIV47b9MLeUTkZ%jphs zImmR-uOhT3j;p_~xvz5?NMbTvHU@g}CwDaZXO(x~>1n@}>4lS(mF#O<&M6!ECg^$I zcIapdIdSRhZH2MxWa5KGVWyBY5llmTq(%co!=2|U z=H~N$dG@1T{H0cNT9-k^8&8c?54IvR|2B-|l&jR$w{$6i%`?QXX+^U~9Zr@2BV!7; z+aKG(Cuxk4yUWBSJ?mM-V)GyH0MMqaG>Z*EGSGyYJL5cgh;ME+5GYzm+}kgcm8!KM zXyX==&c->*D;DCS;InZ;Um1<^Ks5RJp)!>8Q#_t*}u2ZPrhoQ2g6&{(rQ|QD6WJ?p%3pNfgmd zr;rQ{wbb=lq+WPRl(XV3Hc`Gop{}{%31E4L!K01}IDFN`!h+dYThnngOios-=f2#e zps}s*F`Viq|K=X(GvqC?Nul0@6_wKdbdUhW9{;TM6T8Xj@gC<*BJvrI3x&|xXnrK z27+_jsK!aQdGVa2BV-}qrgko?`IFWL1>cG8VbA8hd0v0op({v{@N0yHC#t?GwhnzA z`r~h_?VEFH_{0qm^W{>v78!Eo_mwNWjs(Ebq&ug|!g~P3db0A2# z4mSUr!&ADaU-S)OCUe^c4|?|00EQI3YQ$Oe{c8uQlDmU_2Bl0%!Y5)VhoH|s_K=DK zTd3``B<8;q5ai!jfUQ1t)O&tWg=ip*f`N)Z;zA0ACi|<(G3cs~vPcwb5R=zB5CK*S)_<^dGzmHT0^6&Tm z*KHZu7>ACZM$ecCj5G z`!hvtt^`8n-|yeQg_+&q+?eg0 z2alV+hAsvN}H#)yI5!+<(6*78ZL>cBGG11*u1DX7yNHvc**E?u5rY zNtPtPWHn1Zt->zFo7i0IPOr?f$8P}tsi$AN@g0)U=4n(!Pv~e&SvH2Zid#Q_Kyq2n zu#{$!QMVBJ;i-(x-;w`@f6bnlU8c2*@nihe$UiAaj~qR1m?_t&665!OB&u)-i02i| zO%`9C8ycm>+^SOJkgMIHAvOE3r~mF=39P@})sS&2It0N8mnn3WO3U3k17CJvZWs4H z*r>u@r=<^#DlJ$OC(qE{jSK+Lk#T?qrijr0W?ohsHgFdd5a?S!NAD*k9hythKdyqD z4TVkk3(Z{#u@f{XUOWA2e*TQtBA?$@Sb(JK(rdY0u0VQ7+f~r^^lU)oC^@NG6ZtuIN_h7;I}3<=md1#UM?FWX^jE{_f? znq&%gU|f--qjuyk&>Jxg>W`k$C#>;?Sg4RzmS7IeyKWsG$QTKzY>)&YxnW4+&aPD) z(Ucpt(WBDEbO0RDY{!Gvx>mnk|ag}5_Lmvd)v<`yIWtDf-Yv)t<91eXfgX!m@D;G8wJrPu2X_~ zb|HtCkS-0-`^tI4-2S|Cftc>5*sCOGg4U3U{d6iUtlwf`@9I5EX(^jaq(6I zlr?*=Xj_i?yd7W(4AzC$vGWhTVOI$Q8S_VX(^r|e0(l)!-;){3R_ygbJ<#RkgkV;2 zyYpWXbiAci^HQB$*|edEVe!y!lYG+p>_LNaj+D{WM+{-Aq?M!I;_i|nHe1!H5sD4V zTnx_B{bj@MITO(rR$SHe>nECwA!TaE&mFm+RVPZjrYz1_(NgW(QCmn@kfc5!N=$~6RYXE3@Zp!JkkR-7K8-f5v$CUx4O%o%zyWr zD&nT->>9jxA|tXTTZiSWB=ZXFmFkvay?vx-{%x2euftxYYgl94g7f4Cn!EZR@Snj7J$XS&f!UPQKV$ zFHvaDYsGFNX)zIJ2UUm*Sf|)3<+uB)^INPgbuQC9FZGB$n=QiOqS%#d`igPVd#aaF zl^8Z}NZ{s6W)kNAtI_^BX;uHOeyk=52V2xk{2MOS;p7_kAvf)BgDaofIX?EKLO^#% z&$ovE%%TtBLD2Hs8_?aX^-y18OdjeC<_x&<8Vi9hqp!?qImNHkK+!t6F^8brG|bsG;){j&13h2^tXpJvU^*+YinfRN8@BdHtW zs`p`qR`3x(hl$`dK_ek$h6VjN%>1Krzpjhkp`GDRkd4V3TotOIihR-EGg~Rn{i9w7 z@qOb#7Y9FBze^irNqmye>`2!By`Hq(1)Wlng)bHG9X5S$BQAzYzcR*AOwj6buhJci zZhQM=AL2#PT~6)oz}kID1UzDm;=a>FeV%iC9RmoEUC|UCi|jQFUHnDI8ccdVQN(hb%W3ct_=Wq$3T3Q$%cV;@D+{-;i(LNm{DyYg76u91 zX+unZt*X^+Wt9$-3~tk`-OhRO)(<@H-0YPN$5uJ@{cEMr{2OYM%VsS0FU*s$Q>iwGAJxfROdP?nPE zyqO)KAsA@SPJs9W1*EP0zo8v zdF~vvU1Kyd=tSipHB0|~yGP*F>hk&q7S_q?M;us^#K$pcxr-8f{6`=4@n6cE1CcpK zFaQ#`V$+^77|r6T08@==FJ6u5!V;<}a+9-Mab|YKm2&GXv$&pk6#*-%JILMJ<2|lT z9kgdBJQql5SCTfjj-&de;hQ4hJspPjYuNsqbvaR$Vu6}qC}H=@A}+H8dOPU$hO`%6 zHynz4$}#k1Dp%_P9Pl_D`>1?gRBMwvBKH$CXobw}VGFp0hhbHBh-S%a=-hgo5c#Zp|(K-(zRrEh+2pS!d3{r0)c z<_u+uh%#kq26^x(G5dO1?y#9_-`MC68RusOh6HQhio5%|NSTL-xgq1c!Zy$H?WJ)# zgP(?1JR#QNHFKYz_;O5DRNH# zQpwp~v5fVrB=>lMzp#JnYmY5DFbE5wB>=NOn%?bv7My122?sD0uhU~u;B)M09e zG1n8gA3jng;=3kM;l0YbGuY&9yth(f$GsLb0Sl+?f zno`S4C@$x6bJKo}*zgdW;l|?Xs#61%8Df67(O!tYB>#L`(b~$!AdxRTy~|z7qLCxK zCrY!j?8voiW;79xf%oGhy_8j4K2N)J`qH%&iwWuDtQanVnWwRyo(AK{ne1%N_P&aQ z^SNEy@GWi^Raps}m0(KZo!&TY(m%vo0#76XlpMqhbf6$5K^_8|H!PGuKwzX+nB~;MoU>-ihm;~NG!S} zbd^Q!Lqh!mcXjNKM-GMuguTvG6JKU!k^;CWeQS7)_}|&Sjv8v3o_-Qbn{nBTRo&Qj zeRb9#<3_iS*p9u@w>~PKaA672JjEwKq_&x9yg$flZImharo!3sE^#e!;$&pqenOok zta{Q~jN)Sb()2Cqw?}5S3wJ0kW^Lmhfulu2b$*JB?i6KKEt}2G*^Te=84KP@J}Q36 zjFHrqJJpAjUvU-*vy+1CqQfEi^Oa>TVZWal&?(E`jOeyvOS1u9owoV1B4sK2?0GiW%M+iV&86)sA^YY$CDf?O{3hEyCg;cvmi9(AaZ%zL zavj6dIaK2Roo60);^LCv?7CLm&~_s5M`mrNBE`(YvoDYL*HT)(^iqro@~GJmjsZ8f z3vYVEoBU3S(^L)8;>#X?9{?7MvU>;EA&p+Y9J%b)(b3)#QKfOL3rCP=(Nr5zE8#W= za0&5GUO+1fO$}5Lf*-F)uQ+)OOR13Q3&mE;;yEHU;=;FS`+>puXw}Y^lzEiN*vH6VU)(u<02lHR?+Bo zXN*#y&0qmn5>Iy3aAKZg7BJ%^SJ%O6YxP62GU+-;s%_63gqW9DT(oqd56oa{@%I*^ z&kY^L#bd**F1K>(;$~GUlYJ?is6=vF~)>3JPM_VXMzOuQw{`g^<_np^`LF z;}>lWk&#`qDr93aucqqABTL4$SagV*eD%>pwV%i+np_5xlMOFDTtCOZxILx~!FW0U zUS;Z8Woi_O;AnyIx@7TQHLU6DEv65@aG-u3#Atjf0QI!{Zi~d*gQMpm-f1BFXxz4!KWG6HH}@J`8<;nsp5kD)wQE#j4BP-j?@XDIF%~6k-Sp!N&*9)>$h-H#aP&`8 zJ6vC>M|sqv+Fx^>HCd!rIb=?3(tJ`FwQ~iG>MK^mV;)_LLJEmrt)6ooS|_@ALEnE9 ztd>!})8D64Ee@&Gj@qq0?v2Tuic@QA55n9m|B=Jo?GrkVm@e0^h`Rg_3rHjW^}MO; z4unC3g1va6pK&5N-5Swo0O%JI4)y>ZZ9Y-;o^>}_61_PEp^>G{Bz^D_;`>CJ!o$cN z=N>O$v2#i?)RwsD88@cOJ?Vrd1aIk~%#N>{@V)(nj=Q#lcS{9CDG4`IonfxWPBgfF zMyZiUJxvNFAp@qb^Kp;Cz>zbcXr@}zD2U>VI>~|0Pi+d6;oWZF%txu7dghq=ip_xj z`iPcI(dOlLKD7GAu0+YG>wVeZOka*yA*8onBgIuwR<)|1wJCm;P)Z%jY;r;7Tv6Et z$TP4T-+xVM(`TUGP1@dMJ<{DYHJSso7YwY9f8|R4UYS7SKwSOJVtC<0(#9-r?Rtg0 z(QvH>cIFtQEFrB_V~RjtHHnL4Q2Q_x2F;!xoL9E;>bJ`YS|9~|+qR~rj!8-)Yv9$q z33%p5cwhU}z$kB)sNYDudMwEr6G&eedRI$9sX7*fw91?qL!d)@;>22Ib10B|IqN3A zZ&B->sevpiDJO{Ge@n*@L0vgOxS8Y|)=r*$;CtsC&!4gE;@+E6=K99Pk zPwn7esgC0aOAc9b?+ckf#U+BT44vAuyFEj-DkF(mGX7JGKr&wU^mA(nDXKW^=-hho z?W$_m(z1R1)+Tv=*`Z|u1V+A~Pn3X5Tn*^q%wh~S2Bfu_S0xQ(obRxr%@fVUofCqt z?f)ow?OKCMd1RdF6ZWI`$Ep1kZoieB~u{(=*`Y0;XkE*{oF)2j#em`E@KEI|Kn1>XNdko zFj$QE{}&im(ZyBln|}+#il_Q#p8rSR!3UWF|EchQ1*iRgz&*UGj${(DKH>z92OsO6 zhNL87lfS|GtWZ*7lNmccA}lD=RJqxsDk=&JAMYQFa!E;vWboh*_*bHsdmLufz&o1B%4m|_UvQK5 zgk?%7s#wHs^i%HVOKn`*`_W$%DI;!kHKu&hhIu}d14f@KD6F0oF-EVutI?5kmb4zu z)z<&|)$-#99e2%#e04f3EPd>XnT6TeP)|?KuJbX|hO<=gmV+Jcv)&4BODo1`VEx@9 zQ+VA{w#O(NZy+fvnPeUx*6+j?v5T9&pQmOGAeWB9#RZQIz>W#a~KyrY8d?YnVUUAZrF|C}HQsR}{Nz_>mY=bWe6~mLI@9V#17R$;- z=T)_@Y%IK=srIFm`^1}s|XU!m2tmR-vXVCdR8(`(&aBCI2S55cp;vp;Br)b^Zb#JYEJs3*d zbUr$z65X5IkbV-Uc3JdV9=A-cFD@=F&XXti23`5Rt4qT0sWkg%5fe!zqN&4lY*#BJ z+m7Rt`xz(%BG;8~&x`-^sTmu81c3neD^3Ycs=vLJY`{+C6H&@w1*;aHtg6)CpATgi zDTY%h82s2$&R74PW%U4y9Y-#m6j?I&`)MjVF(TP3y@!7gzFDUL-Ct=>$tScKHQWVmtpdM@T7+EWBjTM|KK@avGAvK;_4B6C;gWrCe*5FG6sxi3Nzl z_R<^9P^w42@twBE4l&mtup}+7Fn(2~p@{(kl!sb+89@jRP5e;DY%MlC#juTu@26DQ z^mi$qFJ66eDc5&~QFzn)^y4NuR^;k?K9A7f6^c_D$(0iIQ$~7JTo3{~i`8U<84J)( zB6=fDtS0W;nrFlwpUb-c?I~D_*39QTiBUvpd2aN~TM>0k5)4MJZk zAsiYwHkfEJN5>}OzSTJyhx-6j-~LEMl3E~RV8#}qldy=$`-?ZJVp(}b0@i_do%YNC zE3YhmO%MOwjpJpb%f-TSP=|f@ni;D!G1U_TwEKm2y!@(HV<)E)yGD&BbFKzQb0&g; z$?IWy&V%BBcS4V?9@F7HWam0EuG&M_6Bn3iU}?iLrfS!<49+<`uSch}NS#_ey=T~HqMn0q7xQSF z*N19CP!i`mZ$-lC`^`bYUu*qY;i(%1?{#{}&4cKL)+R^y0>aKEHeli(}%WE&< zyw*=IpA^((6ZLI{N!c{wl2@^6;Wds73EiDfsYz&liEmt8%tM|q)Q)8xqs7Rp1cRazT8Q6rwn zoC{doMY^TRrvih9kBnp}ECLYL5Go<&Z!eBRA7x=4DD-F6*Vay8ZZKULFL;CY`@T1i zDY*=f92Un~tNpyN8pA6ksmV@RTl#wDJ)sqpdYx^tGlc{93H;+bijUBHD?@w1`6hf< zKih2=j;}rSz)5*EdLRfjU>$cICrn?LEwH)y$za3GUMp=LW%V=YaeXRZ{MG8lhi>i^)AM+E z;l(sal3|$sHX4lzI+P6lY2%qbn!z?qfZjT;!d~qT9CL^PBL<`WZa->V_v(3BuKTef zzCwb+2S?%?(ad0piw71~ujLY|K0C=kz0vzxw4K}e+~}1o@3cxIpyv6FJ?#kci^Z!( z$k50Y8E)Cl=hSi^DdSWYGa8<3-`#LH4bK=ZbN0yD*=Q{u$iFo^&8DOv+q01p`m_5g zcfAIEwJGrm`+E^yLd&Op8~~EGzHh{I0&`2ez6~k`<{iR*oZqGv+{2F}U(-Z-^Vw zz;Sz15@c#CA|dQcyx|9NE-fZh`(DB1qL->e$fOF!Y`J$3T+FafH|XI86j z;S}Q^z7iv zguoH)esk{IWA-OjFH%3G0DVxoKxoZcfkleN;QVxQ+4(M>QO-@_jLK%|V>i9Wxgzi3D0XEEbEsoWo+ik@yHaV|Hp*@YyL%Zu#-BT>Jc>LX`Ta<|BR$N{?v#VY zwa`LrK(X~=X8OQ)%p`B$X6n18Uwm%xHRGD#0@V#jZ*y~q%LGN@tQ)pg;`|psdsocW z!6$8J(&8#wnPkIm2ye5tju)L=`aWpLp?STWSI2>h9i>hGKP+Ik?S+B&eyg`?9etov zLbc$znO3RyRUORQ_%@F3RAV^rrqrlaEV-kkTB4{B?Tjz;Tk z$w2=^w}W-idA*+CZ9tr=>o!QNHRokbo!?ohbFBRlVr&W%7=ewU_AoG_3a>s&piLoR zkvQ+O_J5T@{X$3Lw2&D9q^PKNf1IG7U(vP=z?~Gicfoj4*8Y{(_9VNHAMet47BqY@ zNTqMrWU%ufC3%Nech%ql+@Ud7NcoE3vJs$weeBiU;n%Z(td-*&4KV13%ICArpU2c( zUj(4%jeqK+h@xV>uNVxiuX>k84tP_oj4W4yNZso`8uK5DFDc2$L7Q@bfN+HL*3xyx zfY4x>wANRn{@B=P;r?Gf-6FxkW|6ppV){%k-yDBFAN0;#Mmp-BZFW|A8wWMdR4x44 z&UGUlcJhciRbH3**!*Y5B&pc#D*f`fgSTL4!cq~11B^R>j0BiPhcOQ?UY^L3a@!p5 z`t0A#Tj!Y$qJ!*p>z)*B*g+ZTt*S5QZ??G@>LGh)Mkux6zK);DL|(|hPjl7?lP*X! zksR14^i8_M8e0OrsUn~E>jXF7-_vWYQ%h~l_OReuW2dyV6khL%XR@+b9JFMl?D65| zji0WrO3}NZt~1ix<5v(*lRZlMzc5WLjyfUmOu|n`x7=ZK^#Xy$ea7HF^#gJRkLz;Njf2#B3>djvA$uFiV5P}s z-*ca4?-30xU;P%$e)kxHx%$KD32a(AZxpIjR`kG#KQ8FodJA`f(7fft%f$>12tgg@ zZp#3dDbo1 z;lsNU!)(lA)-&{63}Tro7K~f$j^wpB%=Yt}a}lsV-tRNo0wX34a$l79GFGoR2X6NQ z2imE44>t=+Y+zk-*J3TqaUyb4LSkn(xe;Ew`Yi%b;lYN6I(i0`V+l;Vp2_=aYdg^B zx)o-|d{tYPx)ccYfZd);vU3X#MX zzre`@Sy>Wi`fQ-1U=8gt{rr4(jTxS*Lh>l5ScHAKusQVQXmw1e1%3w(N3B)L(-_f_ zK-d;OMT*n)x_4x*s82tSH=|+K(h{;hl)5S{!p35$ehZ6>$iLh|vV_gC_qViShN5TL zl7g%IFy0g-o5H$yR=4;(bBi1G#16_a_IzdorT-{!=7aQD8(rE-0esx2CkYT(cqZq) z_UWoi}*v0jNgw&g{*VSi;s=MrrWSDNLPHBOb zZz8d&tKmbsKbFrArGA!U&8DU#mz262Zo|pPmUA2P8+u2l3m!*g`hRbcZ!fy8YxP^U z75XYkwI81~cs*wp{w>Bq-ScWyYRjQZX6e+)e!l_}Jq`!xGiK%4$$Y1_Za;1PYozld zqwG7_ul{XDm+$Nm_5&GLnM|DuAC3)gW8@ehzzV}oZB^}c9@uOp+h*)r45xk;rnLdg zy^*w1ga7`LUs{ODvA*p8TSz#-zUMG6eFErzcG&X22zKF9D2``EXE!J z1YSqp)VvuE05fU1$)dtvV)_cOMTh7?n88KN)tSlLK*l(6nMAGNcdG@jVZNVDpZUm`!zOmx2-+ts~Vw#NB=xoYXOWVCecuzmBV6fM@p zMJ+@&5=8QuBD$iioYfh*UtAQExC!eL4_sOC*>~suarw!3ZaMIYUd6K^@7WdE;8i8Q zS%*1)T8fgha&3-vQg=_nZ1I!2+*aMP>5zr9Zi_1M^}1aUY&#jZH1+kj_e)FI#$URx zlgD3h9mVUw&GD8ar+BX8gH)SQKe|>&`PTm^f!h5e4Br%enC)|PI1&hI`cOFkD=_gA}lNsvc9*Ww=F85w8Gvf~olgSQdxyQKxV67}rKRweY<21IyY^Key^^Wu0 z!+PLXRbeZHTg%qX^TGMekDgs#oP;MvD#;n-N{L#Pq%j_p4+qhivy7iaa}OaLCX{Fw z`{kScn!956WZLgUEk02XX=EmKg&JiKk9f{_Nk2we(62ulma+%eyuKq0wh-{Ev9g12 zT~oDBW*?Vu-EE(xoxlBhi_7?u&GSx*@Q2iK*G#3eqnV$)tIooi%D$beg16UWuzqu3 zd($OT&&WGnXlk59R4kS7GHk)Z3Y}_a?|nGesVdxV`BI~MNd@Shp%(lo+G__w71vns zMxp4l(d1ie!sRv2QLDNHrY8kIqRtyjAHzE#M=mCMolTw{u-6@0e^!5-3I$!7#5B!) z@bXi5;Qth4d{V6RW`8`MG{r`EzQyS~YSeroIpy)NW`_`cYpc;lH9P)TT~n#xMp$49WN%)*y&W+*RNtYf(E|Go zQ92h5SN2EB~#^dvi-Z}(z% zSrSRjXjU^zZ) z^9Md|m-EK`QwMixpp0j)%l2sz-AK8uxWvoNn&Wh#`&OD7peh4x*n&Fyq$7UPQ=XyG zBzBVbEH$ktaVHoHd^<&R305YSY-Kqs<-Wk6I?Xv=;2Up9XxlrIzxXS&Y8C^3MGt8E zLsqj%Us6(_g?)24CgqMVKXp_xq0x;5$MEb^ddF>-q6$55vjmKO9g;m` zJv8Y(7=4Nr|1@i~O=Gz$WdDa$zP*xD7t&}z6x7a*p0_-1cMF3;@fsT&cNSKM&QXGh zAVf=yz&TJQ8mE9eKyK3YNzlftrRSf3SxMWRh+{z7u#T~@r%DpPfIv!Gjm$9TV9*=7 z@TY%ier;3ZDIVu2nzC(x{kB`uY42v^UgHS_C4NZ5F34hZO!UNt`aQzZ|BZhEtWsz! z*J7~*6@Equ&D3PC;h3c;M?WgCVh4lIzaoNtvB-pkeHzDrLX8{qw-(=7iP7(^p|l4G zeA87<3x~&eyz2TLq{LHdLGAK&S~{tm{<(}{PqBV|u}PK{`o?HDgI9O}L2K4tnoLn} zxvT}VD3OZ=1yg4G-qPR{ga*xn0y3yiq(F~dl6>~cFcA{HiPq;y*9Ma;-0<2hI%0nH zVAWeVtF&-^keYPmMKWBffJ2wS!U~HcwxqOsl||vjqlAw6hsFxo8516fx@VVa>i%f| z89U!1VZMe>G<_9_d6OYhv&_+tL4rI^baZ?Vg_3$A;D~lGYH2+VkeZgpK*kNMDP`Pt z6G0)L+73w-cOOfTyzdTC=h0IkboH*Yw5SV zsj;hTu#Exe)n}%yR;-YkYL-DA&8Ju{=JItLBeQn{HG!MQ_rZ!tcDUCQIf%JU+kRqY zZI)~Xb8IGMPZd%}JVD=ZV-Oo6dI9<3D9}}L&0Uizwt`!^Q-$v7>9u%0pQL|J9Ayx%&*j$qN<&WNEBLcVbn}dQZd+6i zeT~Y*QuYJAb(Yq81&pnpp5aj`Y%*&j2i|JATZf1>DNkDx)v=~(lScaJ0{y7V#d}5MnpBgI}K<^HY$2 zyt6Y>wuTt`yYQe`)K|*s)LoCVum(%-8$2;uGfP#k+1YC+0<1 zhS5cA<1J6r2!D8bA6`%cycc}31npH-*AINo{EyZ5Exvw@eHOIkn75>N7_cn_$sw01 zFAt0haI5$l*Zp#P*>7{D)!h%Lm}?F>-X*?o@vNSHsS?o%kflNPcZIym-F}d#yOs6p zJ~ACTq9pu*WB>=Tn|15w&EltsOS7@YlfX`mXdo0 zZBKz^_C&!Kc_{v_*yf;fL-SHr`mvh34QuZjJ@u~KJ2+xp#_^MdS@)(?MU%wEiqU?r zJDE(?r{*A1w_Jb!F=Gl5@xK-5gA(k=gs?{czyb7E8ofV$JlI$qq(GLmfS?uh^LrIe(o-Ao9N~J= z|FD1=u}Sf*=Zqs!F7;NXWIU6w^|vQtv+)vu!OdEOhS}*VA(2AX?uL*T!Mg`v7{VSl zvQ+RU9d&(vs^~sjQ-W&0Om&G;H&TClZn#73X?Qw(<)9#&A3Hemexysj(x6^U&t`|_ zV@7KRwjf*i$Oq#6zcQ*;!Z|#PN~wR!-hFS43gEgs~nU(CL`7^!xj6hLwbx}usD^4! z|2o4?hLMV_YVrC;%J%R0$q;RxX#9DM98{^gZsZrl;i)sGzqyAsRgttMKJuR)aXahEzsa5ay4+utEz?cDG-?dhK*}uwGY0m+k zZOBtlWfIT+XW_FAT2T`3z%B6X>D$<@4vf$M38v*?jm(^dhtnO(IY5I{q8T%Q6ZdN4 zU~JXI(Y=yEml0U=jWdUvT|Eq*>k^Uh8kvdpOIx^>h++2Ipz`1*Tk+?m-Fsb&;^}!H zydI|Us-uv>s^pgb7#MT+tw7t1NaEo67176{u(xuMm`6k=33)lK{Zp{jmQP9_a9LMM zpL?35KXsdQbN4(OJm31!4~2_eyxXwH3GjY9|G8gfTUCaP!R73FeNXc5dZ4=dLx|={ZK$tJ6uj4 z?|iD!3G#*6uW@u$e(tX`VSg&kWqU|i=CJBVc3q{Xzg3tcGX-+QM? z9G~kYjUEZ06Ip%l&k9H~9tWU)c&;ii?q3}aQr)iC1l>mY-$^avRgWZfKUn-3%J$O; zz|Gel^=s9mLSXwU5a>Qdl6l$e2sypH=>6o$>bYt((;^$6XoE*0vEKWFf~Ch4On7Rg z8zXa?0NFM9LuQ8M^gfxzNM6(-_rtg+&xbOL4g}L&8EYQwTSZTR(_%WaBC7I91ow*T zca^Vm*n%`7YxR_sPA0+!?wOZY-#+wq`jPvv?KP?ByWlTskMG8wg=L2`KLg6fsG90p zc6~LcCHFGPU?wJ!`&|e#_i}z@^iYyc&s{9E&`OSO!!`Y@c#$EM{Y>#)lPl%ez|OB( z3PzbFCVur7tQ=%fBb5~5qEH1ezmd^0!nU<610?;{65b5T& z{ax~u7#tDH*dRm%M2GV! zjJ4hOWLp~+ore{s)#Vk2j}2)hIx(+MzL*>J)tS8mu2WRD6Y#v=#3{(j>RWPD)swzg zr|VhrJhrdMPz@|ma&Kmp$zDA}5dmUwX6_Reay|OA@m##zcbQRhjt_D^z2)_za+l5T z$(OGrjw@kEkmsjz9xp5lAy$R=DK$A|WF#qroqn*d9ZS*OmFvql+#|!^E+`z7xUy>Hqec_bD$`6T*1)fU`0rnQ@7KfE3m|?jcEHA$ z)lJ!xF}U`PSo~CgD+XYI!0^L{olJZ&4ZYWmoa>ym7`z9TNjEU-ShPz5RT`f z6dYL~`_X6#)45&K%q|u^XjLNhY3^0*h=p`@tR8{KiTh-w3XVTC(9J01_WRKM?fm7E z$?aMOGgBPsw7Rl_Us9DjWbIsL4@i3pWyZ6PJKp~|8_cbt&<%TH-$G$sEiwCpRH6Kh z$ivTNnsb`1={@FEHQHm(*NV<#V(p*4O*YKR&*U{~89yeN4Ef&OI7?|^TSDxDbkzt6 z*DBaO_{up^nIL@-G`8na>pPc02go{m{e&u^Ltx*nrz-H}*uMpA2Yc|pI5X*RF`X0i z56}#&zTd2h{}T5>#IN<_?;B4=SRA51WWB{wN@EllHMN(k|EP(A+*80~5H0GuCt`Tw zL(h->OsfzUgO4ArGQ+kh#in>%JDn4L_}Jp|Pnciu#1Zg=1IMV;3bLu450B#y5eL>1 zU}qf&`XOFt`}e&1_2@h}Nf63gt;;dn$jY+(Pd8Tux5W3pG&*>gIN7PMt>`HGzp!x zjl*2!b)kXAf40%vr=Fhs1n6{win*ywQ3;H}UMm27fCq48s8s~2qXyNCtDrFk#jD$0 z=jT0dx6JoJcl(qaR!uXwr${x45M$p>Q4^mhn+^-teT%c4t-hpR2-``V$_J(pIQCZxEfH}B>?ZBi9vM4k7aRuX$OJF_nlZFSl5`@JK-S;2#A zQ(MW-kVt*hA~1){{nLYb-P%%t2%HNKD_tGS2RPv!#@BNv<1==!be%+-d+^zZny-ds zssd4v<^`!Y1L~rma==Yy)Mwvgu6A?AFG;`HCv5I<50~i1-tbdm0M8Z>8w-sHmuHZrV?{h2q%!uNE`^@7EyR>hGP<+ zh+f8O8+?4hjal8UiQ`7dg)yujqjv{T5lc^h%q`yx$K~ytGP2Y!zKM;hei9 ze&BG&R|GS(?*VqF(gudEpN!{YMcK}ZD}Sxd)qr3JEN$ybgk(x(b9NY{i^cW8^``r& zwA0=09e3UgFo2j0P-ru?+-bQhCN}4f&VWn6Wpo3OTBx(fwK3G7^I4F@*5A4FK9pd2 zNUd{dTI$GX`~7$WR$ZD|TVj_7N=7o*;vE`i634SQ%ULaAA3Anx)t0N)-%@xo=_WEw zk~(V+waoIcMy0EDUU(>76~^h9NKm%c73}dQ*lcnY{Pr0>eRzDe!%3XaD-JF&8z>Rb zya=Z5B76)jPXzA$JPPG}YdE<+gx9QNbK5z}>@ax#r3R#x4r_a%_I;W?ZT%;sj~1vN@SBcGI^88$vUHDf>PsNDyB z`4~BtoB6j>O4RyrsnZ#77XWTRHgQ8O)sOPMuW5sj^MB3rs=vdA6{_O}mYuw|t)pF> ztafMRZkC3%+>^7e0#=2)ZVu%o~!5f5;otLWJecq*JtA zv~O{QR~SnlNivT@(vu^~HO?=*(Whe%QE@qWC$*EfUWc$&4N)zvMsO|Uk0Lv(uI#vn zObC3*ZRJo1qUNJtS3vE3P@%NVGxH84GOBq>MyycJ zE5|aiE#1japL(pf2Zj@_vKnwC2ufKT(Rf>LM`OR-X8!rS%40e@_3gpy_YIhsDI}dx z;SX&RnJJ}93W_}wiAezQ=VBcPe;2jdsBZh9t4kqZo2(JBbctizac%n)H>6kGV<)4T z*`wKUliI%+5{t}5L)qn9?>k@}z)fKjFy?YhgHS0$uhZKkT(!6R&SIQnp|cj*oy9w-+7_6lg2i)DPccr{Z-6~heyDyTWH595qouf8w(Ue|g53Nw37 zePU&S=&|fT?kwIU3p1LJ-mo5(@92}go59`}6v0l%)-GO;sfs3z6L0vszXLe)Ggr#% zd->52wlyFTv)@A>%TDGxBLK&=PYngqw(IQ1Hd^XQX+5cwB^5^Czy!r37c$>K_!%kZxUopar zv)=uBr0VCUy!kr9R4FV^qs{jC$j6d1>X8FJ1d~rV+ZxF$c-ZQX4sJQ4$hdQyn_u*~ z{kxm5fs?p*Zzc1(CA&J(CD9+B#{-qc<^0b!h?Al%tgp3SD>v!Bmm4~A_J+EA;apjEl4fTsspDB=d z63{qxd|q9rpbPJlwc#srh$}1ZoGs)kn_%@ZwRg6+kA6J6>PnJHot5`d+!QZcGa`>{XrX;yMSdl^N2c5~-1T?x`7z=oCo3{ad+^LfROH;FXYh zQt9Y;82Z3gXJ#qo;*<|psl1Lva)a-xN$~j`cD-IAu2&<$(2x=n7a{A$sqkNsh52#E zRyQgITjKe7pCQ@kDZGlaMhfCC$%p;W5~K#9%F`PC-Zhu{t$xp3sMJH6<&>Eh!)4%37)&O&iTievhQFbWMN z@UoWr8tqBOre<7lJ_90WD-xYpZed?~j) z2OwrKlf5(+K0y-89W8S&<PwO4apLsR zhCV27xv}aQrwkoO(qA4iZ92uiL*ZVrAM}i$K#052eDF&c#*}b4| zN$f5CQ3%k9)u0a?#@sF z-4dzs^EVZ)$)RhN*<*zJJ2|X~IrX^KC>Ev|mY?AvPR#QR@AD5aOn*Z4_XtIi$bR!O zwkF42|IJYbDHN2TbGff7sKp_;_?NWev-guN7_0?NqaRA!{rzUekVU@OH_5t9$52t3 zqkIN#T7QHG(!7~>8`#S$me6!Q0U9~Ud*6XcX`Z5OZ@)O3Q1XbW%*pALp9uz8dBU0X>-ol;L6Bfn6!7v>8aSqV;A?;jsY(^>{l#bjK((1fSi z@;MlB4-V0SG*xy4S8ajGKkcU@vC<z_{k zVnEwsFBBPIdzorqA>!fE^j9h*>^jG=QV{W`19aQs7>b7b%fk{8fxITJPUnNBX`B9! z674#g>QhWzj|R75o9XjgGI>0^`L{w%VN|*kbdrB3%A{1 zfP&-H(l^T|q%~#O-=G$RUT>Uxmz1lC7Nad9I zT~>s|;zRcmD*CQwOy>CT>$U8tWeHBp%PrMLb+^~E-|NasEOkvlpFU@rm9#E`_}|f{ z!yuOXqczouzteyQF#bJW8_na;0JxO2%Kql^g_$v?3I z7jn3HjPXS1&Z^G5o^DHY;%?@j%dz!?%ufk(e1GjO9yYvoa-VDtN7$}4->aM5?v2W( zx3jD((=n_oExfm0bL*%%0DDqhjtTp;+XNeJ8Be{kc)VMH7HIlpRtsTfm7B6om4#39 z(^anpDG-U76x_0^`H9!!619({u74I;H+6TGLd>~wNV!kklkq4jnq1uaZn*CDo{GW;@V7fsIc=3P}#^g3t*V!pKpK5h`7<0zIn6$y8v_R)R2T#{W1ziUaOWNOPa zpPX8;`~76`{HsQ?lJj$ve(xN6k9dhTMILMgNJwyPevkNM&Wg*@grI%<>NOpOR+V4F zucx#}rl5+EKOh~KcFM$w&;}sRxV75HHkr5HB>&~4t3t#+h@jY!;Uu=GnWV?hOCIFD zUxm%I-IGfk2Y;--pG;OXmSOT2zfAlr+??)+c)Flv^RStmxB6^1Be}HQ@VGr172#w> zRJChlsVabkj2@51U^Em>9?tpY_n)-iGN7Ltr>mMW;(82n{TcbhWN8#bykLLLp&0Fb zO&y|Pk^`4*a3&GK1(d^a6ni#o4OEk7`5NJcN*AmGg^3(;61*1CUd*veD^-i{>x^-# zSs7hekTGH;DUyo^PrxC6^rPME#A+eaDSX0!@gsx2AI|2m<g9J6I8zpfsLq_v-NJIb3H+`kDB)-;V>l#6T zVJFv*M#k(rB?1fYkoer5)9KDDzSRbf=!|3Wt7*dIC$3nb*HcJTi#C?Xz!%iUJP?C+ z9aA>j81{`WnHRYq)hYleXN)d-(M2E%s8yWh+*c z{f~jZQ&;o}n5W&Ro(a%cH9H6AmI1A-fYWY={C+(Prk?Qods#X>Em6hU# z)p?rxhk+~L` zcu&Ry8RDDNRjS66rZlXP4k*x}|6orr9$egf;tZYGwrW_dT4H6( z2Bb;j&NoJ-s3%!_l*02+wE!C=U!aFHDw?yW>Oz7tq#Tw^CU;_UOnwuW)Te9iNlS=y z*|T@(^n6=A8l&76>lZ5#o{IDHq|JOMi6Gf$Iv*AUG;PJjzy#(U*7v;k7#h?h@K;Hy zI04>@zQ`kIFmE5eq+(&O@Z|wJg}Y$u5^4~EZ1TF3^HZi(L)D8qz0tggV+^N(Q$dkm z*Ne>LHCBR}$@nVG6!HQ9*0@(+EnR1%8Z@ONenTIgVQXuu8T_e?U>m~K7&HVsq+pGt zPvdj@VuMH-WBUvr_1GZWk&vB+RQMSc(rcbKpN~}QI2pX<*6f;QQw=&E zS)tih7y`9oT-9694(`IN8}=|LDjEZ;4P=@8{4tPXANAX)gU(w~&ztZa#B?p;R4P9! zlcQ17oxOB-oGg_^83@_^4g+mRmCPD;&Y&9}V)hMyn%@!D6awDkpJrMFT0|q= z?KEXu9Z85L$>P6~ux1f&Vuf!@^!M>jJ+vZjxA09@cZf>oGE`FY+Wblj+~gV3GI?=+ zWs&GVlQ^HGf%d;!$PwhYhIV>T{29=HoaXg_Wuc}hs)@L5F^Y}=r)zbND zATRSyusfp>l<{^}HJN9X)lj(NjmaVHt;WJRsL$bblwGR^&TW^l>u{Qm>!C!?5GwcX z;2IW3$4o@-hAQdiI^*NX{~q(|8Fs%fyR;3U8!M$9sUEH+!ZQmv__{z1G|(=w;wg3; ztycN`NmwZ+NQ8t^hGbC~zAy1}zz!VnGua>VfToZ1I1!A7<(L79hdpq;da+LZxX47un{D+H zp&2b2&8RWz)ej#S#-q_Kw2wcS3 z`hD=gS*fC)j6A)pLB^f{h&6&P?FC(+Zv96N>7NqM1bXG~$Zr zDDIG$wk2cxMNg1`uV60i+_-I_j(xc)8-SvDI6^qS<5JSDEsN#{aygk&q{`RWI{3gI zLvEkkKKijahQ$J*E#{~Upx&3b@?KqdfRc<}Z~gah)r3DyUH;fRL^kF)(VYeiCkKAl zgYNxnUc~DfW5?xw8WWj0hEDgb=dKw&P8wI;hg=GXz}NU+UN0}L(R#Muw0T3*>i`!# z{`WEJsf?Rn0OyZWGS&8xO%ghc%-2rGe9xp#$RM?9R9z5_szp654HN6s0^6p6J34xH zCRcD+L0wT1_F;qCQK3@-c~|1zPljq`F~mU1bFYpsTRJwg#`WCxb%YX?N`3kQ;`V*Y zH1b*pxu3AP4$PgUAjC!8|E&c$b(^Ba4jo;weo`pN1{KSD*)v2klV#9gJ0{`c)@sV* zy2c_wW12n=Kj1G==c#s)UBJ+$RRED5__LV_i%PgykGMD+ZzNnyU2tpWdJ$WxQ?w0H z7viGT0Y#gSDEw+25zM%RHHi@@TPJLK^e82%m}Qa!K|Ze2wHvAjhp#+7o794eZ$%7S+LIq* zL(wW8NBvcfo!KN(PyiU!+dzeE3k&Ajh=@8P0F6v~yiVy(7u}34jMO5$zn#V5^|71i zQtO>sTid$=Xr0(g+X*yYKZ;}JdRl+(_ox8!%j#1pn=ZP3nV6x_^ILEL!eflGl9y%HuPxxV*>YYpAZ_EUoN#Z?pXjdVBQS z6jxT$PUp^6E#q9jBvE_6n(1_34-8V)@*HaLu`tiyyftVX=qBc}83{~o%5(NMqb%~e zd&u!STzdVfAf#DbF(}q)oPy(p;yBZxcl+#je+*f(&v<`I7pMFX6ASny9x5;N>ceNG zEon!Wm2q(KJG`W&Wyxn8rDSJwg1=CXJNx^Yw7Sp($>Yk0iCsO!C=UhG1t5 z%mV6O*!VW^hxD$+tC?rJB3W#pd>A{U2i+uGmMaFCf3<Z5ErStFK@Itd)nsn?>lY7!ae9?{MZ0cmN<>~~wWs9Q#au{LKWk;V-NhQ$2V%Fd zrj4^wnz2pn`8QQHxJo8)uMmkn8`(A!aew=rNxL>?jxtp)sgvh*`!=p{Pr6;FyOU5+(GRh*w3is|0QK4kYZwF6hwMAw%4d`*`>QLxJPwv!Q z$=6sW^>?xN3{eCukHFocKUokirWJSpb>(&!$x-KIYt2Uud!qSJQ#`$n6_)S*p^&!T zG~OLh4CpoVOmBwI?M$yb8C(Nox5Uc6uPX|jL(9(x4fy+OR--HLIgQqy)&>o*{>Z`A zz6+P*ptDFn*QMtwg1q`$VH+EUkHi>zh!|oqSbHwW2QXdWtt?d>8zGl|2exFkKhl<# zmb6R;ktz7Ie*Yj6{u6NY1?#iqkCN6?8HHSYc)Hhlg%`4q5aiJt<|9)|&LZK9@`P4j zA-p$o_x?M?)HZh~%7fs1VB(g|PIY?W{bk?o7~9h+u=Tx}_`S$*T?eygJO$wU+^RBu z|8z$CcYp9lva`q?kFk_fMMZ(~0Tb9d5Ah>o91*yosC;@8EAS6BbX7NjlBdTeUV#{y z`X5cb-2Gvb!+++MiTE%F_SZCRgFsV>`+UX>*r-!t5WD)iXv3RQ*LdlEf}I|(s`1Ne zqG9^bKpg%6{#5ZNp=R|XUcX%5_b-#R9s;MrNjmbxCJl zCrCxRH*X6DLb)%!f@`}{qb2JdMtfZ285e)y6ZR@H#h*S>YaRCM?k#-&4>@D+$h%oJ zS+AW88yAKiuJv8zsvdvjYKDR|x#4MExy;M?sbq!P;jl`s=rG}CTCVj2J4x-0PvuW!7kZq~U51{EvLB)vlfOnviRO@Ee?OCELGq6<_TXaI#|905>5`6Y;Lj zAW^tOBC>H+kbyAz&j66%lJ7!(ppQ`{|JSE)onMjwt8ZV}+tf^`{3qHw?~^Z;vIpi~ zPfK}+N@V(xd@03wVJm2&q>RV3Y=5T>LK0r;F`G>~L4&leZN+_^pkfN14-rOZD`dbP z3QkSCQhGR2_U2Yr7mwy-uJJQ>H}wgQB@2mOe1uy)Fm!C~yko^CWFhzOKy5%KXI4*t z|KB~=m!UBA`1Qo<4~jsq?q6v!ncv-K#uDkXr3a4vo^Y)F<$^Tbmuh#gEwPi$%pX4{+)KGCSr-Ri#sLO%!%_Aa)l3>8He%OTd zZ-*cya0mdC@S5{G)|8?!ZN}T!1%G)8{b@9K7cu=pGtT6j+&(@6R`WmqvOZX^uCKj3 zTc+SO$9GPY!+xi=49H%fZ-EyVD<>+af^(mcf*b`S{N2r8+_2_1?(Ul#=e)lZ2Q7BA zFuz|qo>Yu2fAI^S6PHXIZ+e9!$hv~Ion2fa`i%Z|MuZ#PCLuo=hq*2U`E z@)}U2ft(BgLn9VAP|glo%(J-h-`NP9DG5%q+>rM7_Ego>zJTiiY&keMw6vDpK$Q}7 zB!2-WyFJ*IW=h^K{v=B)_x#TVerhD(%hcZ=Kn-qhcayUiGqI#-caN*a2+>2kjA0d92x|}T5EH4jBk_V{&VeOPAJ80|^nw*+^Onko{5z+>CpFSt&b$oUG#^7@F zGr|Lwmntm^EdOQizVAigIT^SOL7|sTWMZ$ADa_$f=7jtv^G8{h2`Ci$h)^M~wc?to zuIrxT`a}AnC{Zx#gUI%SyxH%3$ia=zcppvn`kk z0|%?XVw1ym&fkZf-?NU5%{~}zxo0NV%g@6>fnv4&h%1hAqGS6m?^2{*gi@(q$8M=i zAH)Uv2$9men>Qeb*7D$T$ZS>-Mc4iAzYRO?tHF&dhn)Nfi<4A&M<& zY;3Hqp0I8FdnX@(vMD(^IjN~s81QUt^#+f_plaPLt<@_k080=vMYIA8ngy$j z%B~f)JYKXrICxTie0{UG_nzit=A1Um;&!s&CPehgBzy3is$Xnz@lsN9Ff>&1_4OD2 zAYk+XLdK|G8yr%Xoe0>x>IZN?Jk+UqdTs$>Ow)?iAO21UCX$Db?e=szm_4%5UpMMA z&e-L^hUO?i=8q8|7WWq?a!-$T2ko7r_y-1v3$a1jpv(bqO8KUUp(9xf1vS)dlSM-_ zx&Iklo}{9}E+=tdPL6jO6qqeT2ygI$7ZliBt55#m3i-7ZIuwSrVM+i#r|SDnN#{#HSI5-! zbihCH@XN60zVp4ED%<^Kwb?3?3I!Y{BfBk-Qyf}df&eu&j+}?y64$d;xDTjcs7w}* zli5ncDYz)!I5~MvCI|i_D#UkOJp+;!bviYt5PZ~i-)B7n6jX48S3Es|A99t5Fo7C` z=zlK@rWZib3r#NPc|KHl$L1payOwOZ8(wy(I(3KB{nB&T;U4aF_>cmjCVY2 zfdaZvz9qEOAHO};C`_Sd(QMiZcERGC}!-vX0wl`+C ziXb;CFl672P>19lzPTXLjI<3lU(t0;D5rb4EgsNiIKWnp=gjS`o0IQ+?{U21^0xo7|dmfoeL@i2WF$B zU*vZT=4TlIp!2_9-xGVkOti~B7?yx8v-bU*B~DTkqpM$fs5-RlL?BjmNx+L7pM5qMxzRaptC5xI6-HetQgDlxcQ_>>i)dZ*aefIwZelLhEslclKhTZI_X;>MuVGU={f{P^L`jveQ#OrGDV74mDY zK-%qviry36JGd&KH4G#EF-elIpvyKfw2k#0fuR zNUFu_VY+ST6)sHbxcZVeF3@vV9l%=FsykNy<^0rW_IgF(h3l#D{T}!csSah0tds8+ zR(PK4eY4B2s*#Z$03nF;msDc^b;t7j`3f>aUC!Xm&<|o$)1^!jmxb7`#O_rjb)~P{ z_4U$8_A7nUd14Kz#lJu$P3`*+Jlju|Gh~~Q&TXw0?mc&sRu#AloOy$*P1OG)m3SNv z>>Zt+W~4Fq34u3`wyp%P4gkkz9U0_WZ&P_7f%kkNoR{emVm$ihU5bwG`+lp}HGvc> zcgwbo7=h%8OddSiwfYjvH%8QC@0V84>x-+NHFwnkG4Jy@o5Gu?yr`w$-csJQK&!Nv zNay3T-4Q^cbyH^Ib(4*E$8+E6-uqJS-U#*c4`d{${EC(j33V6&UlH1->DO22cW(2F z&}pXoYS@Q4Y+bfTWjjvsh2D1|mqz1q=>}1);E#wN>ocqZ1(z!<KS^nS!hz z5>orcj8GOp8ENInpl{6eg7ocuJ1XsrcUT;1bY94uT%h%7#6Ef_d4GG zC$oi}-;p2E9diy8K9Sc+-r*k9x3d(-_rb2cMqYR_jV#bE3-wg`vda@-B2yqH&eF-_ z+m7T+n*%@_of;^ga#Pf8ozN6KGXA}&utu`nbEdhHZ%q)?7q9e!`6X_(wuTqyvw5v! zwjKYzTPxLgmYmj=7kfZ|KXwR)LFLNDAb{A#W+wOhGo790y{`PY@ch&HiSG;{MiKS_ zd&Ehlg7@~@#~3pay@t}7*J;@(FnVemOA)y}Jzz!Xz?RKx~&QT~MjD{s5?shlr8V%Va@XW8vQ z*`gNJv%;q4`ryOS#lw2FLk%nm<4QQb`?IxXFPWGq;UW4g*~fj=ZycfOXz@SN&R4xU z+0~5hJ+~UsGK5IS#x-^;pJh~z#Uj=G9>z8bxAFFf@Pw{~+vCf|TZp+VwDI-50p98Y z{8c=3i?`uNO76ahBs@427R~PyX5F_RN6!Nns~8Q;5&bq)PISj9eD?O6_d3!aYx--P3Sl zr+49xf|a|kbLY#IGC)@MvbZ5h)Gwf!mQ>H49?8TD#w@5iI2 zuAG{j$Be^k4ogA+Zl?zwhcV}$dsN~cjy~I9|o>a4{rC;}g?6SLR zWt#nTdq+gvUK^%9KZ$KEzu9;g)?#TpWG$tVzYMA}gSA_la@A|~YDzgX3vv^OMKxBQ zNOH(c$@{^uB{O`XnVmXaSs5KQEiH$QKN&K*LC-H0c6Y1ST9l`(9oNDI$#sWUZuu_~ z9hVbsSj_d$h)ges$=Npo2CuSNMz(`+Ez$ENEifouUmg9wI;%-FXp=_{wg!*WN`3)i zUMHQ;6h}Z2M2uzSyw%do=XBJ$4Mum|QK<}bw5RdyG{g+7U@Q@!dX<*|R)d|5Vydb{ zFNZIhO23PIxIR&xT&(C!v3yr##)%MBxEJQlmu<1wb|ePEck0ae-f3^B7sCD-p3#O9NIig5#9)u)-Fs?%yUaOTpzga{vo zwr9JXKH@EX6BQ%kx98q=-9oPXi_yY(OW@<(tSU+NvuJTK%#wHTRG~Sa&c!kU)!BRD z7wKwgxlBfu0 z_oDus3+7tLS7_GJKLZ*3?vSdQlMaU}q4ZSrWx19}GF!@8rl$xuzrOf$154gaYbQ6k zJ%&<{haw@>RP}{z#%D)j!Umo+UcBV{aCFyZHc*bnHLT#B+#8 z$%@o|g}=91>iyd!&q083#F9H*0OZ%vYsP=Q!`0cinEB!1&xLv===sl6yN0jQ&BHs! zn73Kw^35gjc==@4WtIH^(aU*6nWmN(@%!ORvxC#U&t}PU@w+6u@RjHEE|W2Ok!nPw zNUm~oZ7KD2bSj0MM5xpJpyTx`lEifxWyzY^(Qzce?7%Z9ME^y2EON$g)I;y5OPk(# zi^`Yz)ytxDN5O8IC3Tkq{tfs)9R6Q_mlhs7VV&}EVnzx0NX^jX4W_Fl#Pn42G0FFK zGPKwL)<8aHE2(c^&SUtzPE;85`mKPCngt{CEI^QxwhTRU&W0#?f2a>DHXC52Tj%x2{nW2#ne)zxvER88J*b^3{M?;?m73-dd4t+^Fd zDTgbosJxs_n0a;HM?z9f;G;m0fSDS5Ccf8i){LnYZEZ*ClotPp&aH#63xr|H%EjPZ zu_#z!ZMrHvK3CV+>=r3*{lpjSe zr_jnKi&P8kWAg4#?Nmy^3H=|! z6c7k_1hc8Bsd@Mx^wpBsr&Ui{-7NL?MMF~88^X)7gkDEmPZ4{B1T})qDWvjfoLN|d zRk-=hG&B^r+jb0KAT~tcK2EtvR+)_@ozTu#=8!=hqT6*`oNV8B-gbfpfVf0&bv?!t zgj`WXc407q))?(%8MJYU@6W4c_T&)|5D5Rk32afotb{%*cU&I)Oi!m$?$;DzAMJG8 zUx-Mma(Vm>isM_J#l?&Qv~Xa_L<1U}?SUQYoE)<-9LXja{^3cJ2hug(`;h)RD^1vRnto2x!I~E z(9>R{PcwABq_Our3?Iu)2v`l7IE5u)cv@PL5WvfS0fT_S*(}n~1B!+7Z!)pMHb?i# z!=vXFkl-V7V?4PM=qEB%>cg29gkamzF{tkyMU$10YB#^{c{@jNqF7nIBDTY8`PTE5 z9P?WuyHU|(rSC*twmnMap8^Po)i!V%Q(+=IuH5ZwqOdxa6C=9P5}hn|I6-Wk5ztKs zmL#A9RNk-siaj75`1VGK-YW^V2FBwMSi#_6_|^};58m0>NcG!(U{zsVqWW2+nvIDi zbQG*0Z6#bb{tNFc`1^lgE&m_r2&;obS`o~ZrRr48m+J)x5KTjI`2kz`{9im6W)!9M zE<@M_lj1%=TvN!IiAdMYt5t1{zTmRl*XOteO+Cj@OsiuS)iB<%Bl0o5y8__(80_?F z78h2gjA8#wh<~tmBHPtEo~ILe#cm1p8F6Yy*H!cI@1CC#@aFj;+JnPNd%h+Q>|(D-W^<@B^Gz`Tv2Fq?u4vVMv&n{YTa#|#%_7S| z6>AFHm|`8Ba&qUp>mIfU*Vk18KGVn`V61no3%Vsy4400g#@yfHcq?Wh{~4nQPh?XD z?_yKm+_)k0nj5OCyBao?^zc$l3{EB7#avSg3AJ-e{HbLra5M!TPiq$YUmF`5%G;W0 zi8n26^fzNm!MXcq*S(&>R-q?45^npvLb5A#v?yi(&yMjk7QRY_*Quj!i&QCkKK;z2 z5vJbf=Kr@AV46M%XhA_4M1|NWmXO*p+QDN1(lqN9VMOr>D48*Lp~mmkVLu6|gfYyi znO+f+VUMqPv-bfM`bgm-sjypGye8b7W`luvl`Cv0IrdVpoUtPKtqMHm9lVY1^|LJB z6*N^8KGC-uC)9q9mOGCF4EGdwuz-)rYkDMCF;ESlnpjcRYe#>ln^1EMJ}evL=jGjm zgZ92NtjnRotdr`H#$k!YWAKj~uqAMYGOjn^PJ<_#pE3lHY}DPwwuGxTQ_r(-;kicZ zIu95T%mgs+-9UGL80fpKA)(kE8CcujX#H z_yDBkQBGuZBI+_>0v6pn~ATIKj^CzLPM;kHK8>J-RWKgO{wc44dUUnd9!mG(LgAysWSN5xCQ-Za_X7NbZbBzFE116zuEL~+& zaZzA)g|EcoN0KPYP!TLf7;C*Y_op6zYubnz7OYS)l43HU$iU7R-J@xR0in43pRyDq zyp9c^?MQod?42>I0uzK?#~MvFup2b@JDuN-Nsb1PR=t{5ZC@5SIXOkjlb0`(_zxHh z@&hxqJ7u_!fXK?H$k7aiD$CA!^sI3LiXfoJxK7brEC)3ob!Le{f0SHVa$c70Q`NXZ zT{^aXFolI>xE00~8-%U!P)263z;>c}rMM}6n!PCMHwQ7*+0$#FKrdd=;)X*I_w*bZ zQWu6rk9Q#gu>Ad{V~OgqT=Gf%4*GKvMv zy&1Bx8V!q^-&tqj3gc?2*pdta7qo~Fw%Y&UL$*8y#*mz-Sw+lK2cN_*seLyLol8#4 zQ`d$8+CEzgdRdAQ9TtlC3gsm@N@m2ymCq?h#N7TerK_)?AnIBAl0(YH#I!cWd*r`A z_@QZu{1Wnm(!jyjM&7z#KehivK)njCJSa9Yea9t4GcnajHl3RKv9cW-+WW(2=Odq$ zjg*VliN)BRQgO~w=9#lnY!`-pPNzI35_F({oDe*dFBHURa<^PELU+suP*JVkpy6$< zY;#cUC=t^Rjs+DP0s>v+(&$WjmH?!T^f)*{o-PNYz8)kPZ+NkYg-ni#(Xo!;t+YfJ zx1BA;+WyZpFtGpX zsy;Fb;;&FXU4<7`g{(^QcRTd||6!nma^TYf0-_MTIL+YI9eb!fhSqfEX-R6@#eaby zB#knoA}Sk?dl#Jj(Y97s8r4ngC!d28l^S-(SLwi}QBYHnZJ_h6Fa49J>v%mG6cGR3 zdJrWy`Kp7M$-X_|D0G6x!AxxkuQF;v+%R@+b#86R3W4(Jo1r(1#;I%u_bUHZ5pcw@ zr`V{r?lOrX0EN&IuQfk=QrS23Ay71IE?6xXuRcshyoacyxv{ZgWJ{uZG)qT1d3-!j z&hyhclyFN&gKWMXFE5b^<*{(tx? zIeXm8%Vz2y#5XUrTgR6i&HvQjL=V(h|I4E4%me1D!F^8nOfgq_s#y8Z~gmfqQg z#}Ty7mbj^R8yq-<=J*cuGgDevQW%RuCka$MJ#Jk#8S@vEEk`=CuIX`-Gqq}t*~Ty0 z=lX^V?l}k)T)OQVH5H;phc*J-M;9bjqUFQ#DpJ;D@-Gz8lHpa7woxDm#%*e@d3DRz z9;#RlU_QZE`c=A|n#p$AnPxF6;-`GH=qO{uTJ97{I;z*rkxSNpOs$(nPz)8N1B>4F zOIv~vQvN8%4K~C3z}BM`**l0WsU7WT?JyBIHyAj7rNO{s^WT-k- zN{+GxbZ%aVyf6}z&ta}Waib4!+Q+}l@@?;z7NU@Zx-`n!@q#D0TV7gyH#MVswRT;2 z*=Ltj?GS$T(MD63l}l`q{GtjiaL`xR-fA@YteTR`)#1;=|AA{*zL{+SvG#@`S*VzXuoX8@w`yY65z)#>o9tmhk2j5wa6vU4B2+Uq2*^{ zraGfYaZyWKpC;HxL@EQ@x;SOMp8-&Ixp~b+J}3*$_B+9S!D5!cI8mkjjm??jlX6lD zVw+aI!2G*CW4X0#VDd&O*TUYij!~mpK&nQ)(nw~JvvsEjKfU0(-C$X44u2ARUAcX< zx_?Db{J`W(u|D@P6cPWT`S6-5ql1U!mso5LLaU=#%PQ{I3zlIf+UY@4)kRx8^D}}D zoI>MzPx#2_Ni)eMA{800Y6(5%0+oyI`StmEtVm+Z-6}#PQC>=vdihWJziirOIEkJk zzMtus6{w`~RG)}S)y@w=wga?Vfj0=y;@YuF^?XhX)Ktq1qx9aCbd{=+)S+af@n#5t zl=yl2mXY&0z0claRhaD;=FB@->Bb_xjxIcXaGzjA|M5 zn#&;p_oEAFz^u)bnat#_lilSl`u^F^IA@M}93Hp@+HVj-i+jo`);~87kQ<{~ z;+RW}wp;A?^BP8$evlaVjDOa7rD=~;wp&-uW6$500pc^qx=ahWHnPL>LRCT+CXk6QXAbZfSUl}z?h583fhHyiO+mie~TbfF|XZnH$L zYiT*Lc+6%J+k-O|P7I^uNu z-RQa$(AF2@`0TzjoNQp9$5mn?HO`Gz8T88;nCb{wtoQVE9icUrF5YpWTt~@Bq(_vv zBT1gE5<0P%e^t*Hxlmepx-F@%-Vq|;d1qRXld7(%G3cVt;#bw;E+Yt<^xaBJoW{Uh zz0F)7RIC$tD`Ibq@yW=1N){c?lRGe z%bK(G>j3^Xh%1N%rQE5_9~R9*HWl;G#0g(hWHhh|*>MF-I<)&)mw-Y({ctUkWV_2h z(dx-9i5e;j@qS}u-sDHXhgUv|)@4;!(3O?KWpl?s5`L5F6_uC?|3)lSlAkYYRkh%S zCBO~W$U7+W8w6`OpW-OzocmY=r>&x^q=Cvm%f1ms$dtD~o5$9`oOoOOEY}{oq9>WI zq^7I8X|Jo|ge(;z*FMI;s9ic#O+!2G!f_w{n?Oa^cD^@S&;^sXQ0Q5^&Y-l*@YkeM z`AYQ=(^i`Nd=B3I%*PsLJVy>Lx1p*st;8ie=aq2uo^SH%kNxSS_nWS+B(bMa1mHhu}ND-)P~@-R*vXuJbkgR|B8Vq>&)Z9Va0B=VsGw= z^Cf8{_}fa{^;O>?dj|jLYqqK3QFVc9omN&dqcKmGay_~E8N5m9qd5&$v+|xq!(ba6 zhjz!rr0ws5D7ZKc^WMgv4d+`ILQ$n*k)`jDSK#N#+a@Mb_rQ$>l|~ zq@?71Fbg5H+Hr2eVXi(MmEin{-I}&+(7s{n(Nx&VX(rPXuXAQ^B6*m)n<+^KMNXO= z?3P25SrjB&AE) zq`;)mN-6&E32om_b9$TwSI?9;S@hhfO1D`Yi_@h^%JdDqoK75I+^r(4ykGUi6J0i^ z(TC!ztEn}-c#+-Gg5Tah8E*UbnDPp2W7uFSE8+xbUTd~J<yK~lGHFN!2VLCmBsXgmWV4wmFqwG5}UW+Uire zm2TYg`R6Qr;T)`thWWFWCbqZ@8`JSt?%%0JNHc^`C9?8hadnnuM;W|x-Pl`&D|fi1 z>L&~A&T2QURu-mnis$>(b&||&=`E@vn4Mh_S@XIU^EB*K=-dkm)`8G*7-AtkZ_I=S z%X>CzOBfLvqc{B;D|Tl%W2+%_6S}EKMvI__DTgW}oEm}`ZKDz{(xKYYeH#z$O+(y>vaT(oQI3dZ$xUkoWY`kD+~^7L;l z0MO~G5+YveHcn9O?nG~!eHO!|kP))7bA;C%#|oXgTDPmb^63ic{=R%coa2b|D7q%4HmHQyHpTICKb`XHHX$Uf3*-2ub&bH@!70}kwH+}hR@q#L z|5Rj?s(`g~xf)u;FY(;7ljTuF(YDNG8yEP5Ll38hw*zi)>Dp^=>WVa4&;Zdg3Fk;AkoATm){&m13)JZG`=MscQt|j zH~mPuD1O5JQ5(3br#^D+3TW}@#bsVOK03}bQVV0N0tefn&^w+}=MZH{9*X?ZvG1Ew zrkUY!0o#o{uaOMv00NxvTWJ!YYb9#*7SpGwXGD{AiM;SaEfBIz`)~ zT0&<(43pU02awt#O}GCU2b*V@z$PG>YXw{XK#p1}fh`>=)I4Iq(AL0wDae6mL17?< zOfVU>s~DCul2pll&*6i2C94KX6|nPoo|Lk>dw(n3mngJAwsm)tgRL%HJ5-Y(A>zsB zk}d=3@#7^Ac_w~-(_d>|V1^ceTfq9G9&MyV&n7j+juKS&zUHL!%h&>5P)ip6T;0N| z;jB*WRpd?w@H@tx1WHDC7tz>g2uZVU0#Z=1F~m%*#l`UzI87cDt!Co?m+=!LRSrh( z?SVu7Im@tc^A~XE3*OblO;p#r2BCA;`{oaX&mk zxQ(lO^b&q*W<}y+*0k?&2_7z{CTz&L>J*o?N?8NbYCcK;4wWMYE%lxtq8d`7lzJ_4 zMYK2=F%u)Trcp*;v*vJ|A!wpd$nWQh;~2CYFCM)7d80WFXs5_}+V13ZA?d(%U4Iw} z%>Qr@c*m@_cU~k`fQ6M0n29Apkx5fgRV_>zX{y=Yz>j*J_$eShab$Zw8eMmr}7 zRfUNjHd*v_huE5zdoaOvQT0nE2a<{_>tREsRAN;BgcL8{=j}}2yEjT|B>bs687}i; zBR<{KqD1=_$o8&MlljufTOOSgX(0B}UgkQzQbWWxfoXZT`9KhjZg%Asa`b~y1zu*j z9s%o#(|GIHl+t@q1(88LIKsuqbt{4gT+#6^0G$e2FMj1_teBGHbC1 zOP685#rrHu6a+6EOp66oL+cXc4=(YUg5x@{Xpp{YvMee8p~#dgexcSWAm$5py*yc7 zxA5wBn*-A)aeBOp!1*Zz2??eRI$pBQpH;tm&$#FIbMVv2E#(&H`O(flCo(I?4{}jy zQ^GDFh$U2H5HC8RuaV@}jTh0Gq1;VC6)EDxdqx?XF}h{{jo}EVVWNsZ=R!lRJafObI**1l zN(4rt`-|eq5-X>CaMk&VLfag_RKTnFHn(uZ!vj1rvkyeGFso%c&D8kn7^N6{!HIzHkO$NHH5x}&(@t6J=V3mKoT=(xFBiVBT0rdUXuSed4z3=ex-)eXMTY8@$f1Opg>&2Q z;@W=D=wlLFHm>tk zBHo=W*&v|H|G!v!%dohfZQYk7K#)L!2M_KLq;W}bcXxMp5ANN#Tkt?5!5eqC;O@}4 zyCtXdUw5th+`aFIbMC(1=ELlsv%0F7v&N|LdtU*{vUpU9y_u6x@~>It8zZaD-7oIA zNE?iO8Qr#~jVky@GyP!~UJqIeRyS8{9NO3%+*$7alo|zO$O_?a&(@Aw--HO5`)K-^ z%~17fsljq6<0@$CvAI*Wi%F4{c6;zlh;P$#E0Lopzp4->qO*{xQ&7Jmo{iPyXkznc z}c|v$>mnYFot$S*K<&TC?N|0m1D2DBE-<&NI8XEP^NtkA!4&e z8@Q$U=KYOLivpkREiT_MYUtN%qXfpYto)ZS{{jQ0)>=vzoLI3BjMZ!|B1X+{T&(w& zIl`mSH~F0iNeg|z={>kDq|j-E`JY14y=(zgj01LTlUuqtIY}RA+3KDdCRkSpb~ns$ zp;0E04DAXsefPd~X<7VoVFdGbwUmqL&THf@sM>EwY59a~aA*YIR11%$*V_BLEC+~a zYSvR}(3!Q9c^a2G{sv%GqaU640@XR%;+ai4URfOuqp~}q4`Ny1XsAi~>AgU;fatEB zGhX+iCO!Lr9hiN!|DZUyb_(8;(6h`J$B0dTzF;-7k$2O-K)^gvB`u!8h?P}4k?bNp zMx&f9QlfT=F~=~id#tzH^N6WS1s7`0xM?O1Q6&7yM}+<@Bx$3?+;>m>eMS;kvjB~#E+pyd%Fi}9v5oX#h~z%|f-gqn(8oBabsEmbFuQZpI2rr+DlX5k zhR(zL;2p0xF54EzACoF-`gJxmD&Gh%H#x6S$#}Pj_laofRvPLfRnjGf;6F>Df(M=e2c3T$p^A7w??WSHPZA zJt^PBBFh~RoLt^;^#W$o^z8z4>?tnv77woDqDPsWt6O$W{jJ6t$aNP_JX(Nn>}d3A zqYW{_+aKbpewO`wt|W);Kkqc4yScsJ{K?lMJ9f?QVm&{4O@yv34*>W`OItUTN4D_| zEKDsda#bAy(Rqog5yslKpw~Pi<0&2rqt@ccAdhxz>{w&gJa`soTp?&#{l&wr(oK*zRMkoRz1^(KJxcO6tx1XWK>`ALxq55ZSHwYq6G zlCqhJ>K-vj0$t~E0_N+@ddKVBxS2lTqm8A}=zf%J!*DvKWctgVW7s&Si=+L|Ub7N^6ZInZ=KUQ~d%GCi6b&^ya8$?M zv9F3tIj7~EmYk0s$g}F1XC%|*P+V^B=zXlNV5egZ zPQz6P2H)`0Gc7*F^Sr0jA1gL)a3jhSU&B%u^T%fN*aajdUO%vC z5dLp0^X?U^iy!3I8)~`N zqJymt#6S%Vm1Q-+_t*nDbGCNGQFb@v5^ZeadnFz1)3fVyEdtK}*8Zqrku=CNmBURVhYY!2|Z-jLxKucVXd(7Ws z4|cLici&-EeHM<$44?Zv8%kDET~vS9)`t4;&vvP4_!bK9k_vnqh4(}2ta&`AvcRyp zs}^!EFso^GdBfHG4>k!8cdv+)rmfE((Mbhc4FL;~7~gmv{#UNWJ^=jr2eTrC@rh+K7Xssuy|_W?o)s8ZeKulu)f$o{357yf`L zXmrLq8|JF^pbd-=rZu#+D`+eUOlsdKirnpR zD6n!WJQY*6wS^MC4WS!U!*gIrN#o5t1dh{647L!ROFD@kH0b6x?%Fmo2uD_BaWekG zo~QL?k_(qpvQm;Njr;sr2G@K}bwBR+vCWu&UNNMs{J$r$P>f*uy>vO8-+-fwUOyL) z^XW?CkXTtD^lJ$dTy?qJ&_WKeKDWMh5j*qZbDEup%uJA0&|m32_1!c6QHtSz=K}0} zyLM18gps-6$lzh(^g}b{QhdN3aUq~(htopLjujg&N=tu>1XHEqFEaxBOeD!2VHBqs z{HVCRHm@0s?*~8EcTxI-NXAcGak$x!tgX6WWkzw1+C|#?_#_{l@7pRb(AxmFA|@e< zMez@hI$=!A9TvWj`G7)gjKul`?A)>ECHfP$rcX7m&+~AA`;ylDo1qQ%He zJTixNZ5W26ZX&$Tr^X%SppRcaW;aM)~^3GkEG&zX= zi2n2<%FA~>JDp1R`hN}WFu%YByeI3ZZZuHIU-t5`dTz|h9K(+7Q7T@&JkLm1%AX?( zGR)V6l}iq!ey=DP(M>d{ZjA70s)YfHjACp6n*@HcaNvjWzy%^QLIe>dP%%VN=7>-} z?YR9%p`!}1e66FI*2jx9kkxM<*m9TW7eE@CI(MKAIv_Ucoy4ZfN}(IUL`wBT=1d)d zc|GjM3GHX?3;3F^@L7ZgWm^#NB7;=34K#G?#%GW^EYUmVVoND0B&jF5$s$D(sssP8 zRlZDGb#Y-aWY9C80sA7IcYMl#BSvB<#c|tc2O!0JDQ?*yapFa+DUl24nIT z&-B;WfrFBQ$psYiU8p(oCb9;cy}D6sER?R7AL=|`J}qgyh%dv4gL>{pda;-d`4#a1 z>_OKzH>%`TZ|xJ~E=|keqDfIC+hrB&{yuPkx^3myJdkWrIg#Y@7fqv2&j9qKAiu5J zpL@Dj+7rF2mM_Mi{J{m)m^qzAc=3-NIEyZlq%}O`7sr{OSyLLIig(E0RE=if6?m`P zX=j<&pl166IhQxnPKpWbR8+JTOBq*9(K^==&9$sG{-BbqS}10n&&9ui(O$sf z($dma-xG2QU4>7ux-1)~Sr`~6=ql$5uRtGDAMCvIpk*9O_q&t&@BaQ5=lfqT1XL2* z?lMIw-D6mz>}hDDV7|Yn;1a~AC@s1sQwj>YlQ&xNJLOeX7GoKJzrdcjzrVkN!rj*P z7g)>7e-yzety=OSErs{JqOdx=Zj9oR5}W_}Z7^7c5f@gwrio7;zuz4?-Zv2VmnT$` zLH^4VCe(VY@nmIYs;H@j{v{7*XJ$;ztk(S+{Vyi}X~j6^o5`Dh`WC^lX{A7du)%Km zFQceM%;#R-(7=Wnsp}^D4`5hx{l%47{ZNe{@XJOdjo@7{sV^x^ko@vt^ZmE`1(R52 z)=$EJn;l|Z4St5u3G4Q}_SGE|bE)qJVaxxL_jtsO4ii)|ZbY zFPkoiG~J0wW}3^f`24QE&Q9geGH-3?s>cIaWoS9sH1ssIz88;`jJpH-!hhn-Cimf& z54nulJ$62;<+77rX_ok#3r1vWDL0YLvSYoNQ^!^4rzYnxL-S!3d0cmd{r!H|uY2NY z+e~Ge!3SAu<1yr;1|9yy1mKQq3oWVUrk91ZaD7t=Cd~7_a$m}Tf}eh^9-hADFR$QG zHPd(Au`2bhX{_^*K!+W@RkdZ|$8Tc7(`*1DOq3XTswFVf@8?LZ$Qidj1pL5@h6Z_= zfMoi_qMCE>P+S7}Cu$n2S$Z;=GgPu52CQ0P4zj&kMDyR*+5)n^CXvxH(yk#7zCL(Z z!Kzxx2xj%iw^-F*g2moIi(T}nwSUY(D_LlT0~@ZUtIfT4-@t27Vp~|c9nD9J*_~uF z4^F^AEO_F(o=7O+*3swJ7cYrnCX zDoB&6i>eDL+w%={l;&>A*Rdg)%6t=>UZj8iskn!LOjl2@jv)OSP0t-~%{erU{M>pH z^G5;yK*vnz0NHl&9kt@7hc%?CNweCE@yvlLOMv2+wt!0C z_wRD|IbwW-Hzfy8YS7>952Pi%`Bs$ta4jdWo$`f}=rZQUExWe1wnjDIlkvMqqIs=G zt2T{4OP{807Ka1lQ-wcWIy+ms2u*<%A%<=9I54`xO~HTQaSwHDS+H ze9<^OOQj+sk``aM69ECrBelf4FwcrV!aXKtdZ+Y)>=GyzW`b8g!Yi^KR78E4AIUY= zm8Ka!qTct&cBWSEt?P6{Lc49br`Ifu=v+&6Vb9#&;X9rlfWEPP@1D6fomQzee*1m+ zSaCFlf3YnuU%^FVog%DizY6opqT-iukJE0t3nt!eS|E{s*(X!dM(_OR10fbMtaRxJ zU2~NUWuv6qrLn{iO$yTq9Wl^{`5`ggc7)-Ix(PP?{InV>SlykWX16Qrh*eGV0YW?5 zvV|Yc&on)yJYh~O%6t-)s^sK6we$6nT?NNvHbHyYR&1c8?ktCudo7MN^H)a|c1WO- zPegGl8!0ofqZdVWGb4_WAu%Z+y-imw%#rsD^~v{DWm)T&RD729aZO8Z<|A##p4Tc6 zGvwaqA0xb+`02md)g-rOnCc3N0l~=kzO7Dq2>Dinq06kwDorq8ozWKNp62vqyq4Vv zWhJ#*w^YbQHrTXvDvsIZTv*Nf^#hPpnh@C!3+R!e19>olKq1``-_7XdsS4+UU=CHg?3BUr1{) zy&vpAipeT`&C$n9f0>d{B8>8!Wg*1Rwf@St1bB_H(B8TdHm#@3ET2N6sZpcF^V z5FoYDDVZHmwJBx0f2ER3vmYJvsD3mfJPg3^KZ3a-T3+E;&OY=lp+QEii0w~I9)B=# zWJPw|ejvmPSj0&G*n~!cck;DnAy?SF^Av^AN@5KCK4&wh{UTJG$qBm{W61cc5?(-G zxovLk?ZqN7fZMn};rx2Z=^#F*ZprTeQpa@~zCpH{ zVnznN`65%~G<#5Yq&_8f=;*ruLUdx}>5u?mZ6E`^OInrYReSz|Z34c3Q@_9=`Va=bWT}pf91GJgwL{+bt79P$|O&VXOT)Oxwnx@wk z?cx_^C_S-6;*jS9z?91emR)UK`8eb{DOsdfki#>H&6NXs|2_t*jC}Sr8Xkm>EIE2R z^?f%o99I@>yDOi{Iz2-2d=|n$t~>;v+Ob8iW;|t5KY@&iL0HMZU9vY^S@l`w$x+?( ze5j^wxQQL9c{I^h4VSP=oHnWw0ku*1e9?Gye5`TJ;|RKZrQD>erB3hj+nL5Gvpja| zYR`QrO^9E8Zr56sUa7Z_LqeRt0qM62nXsVBbKVHmDJ{Xo@S4zP+!U*M#$Ph;8#k>X zbuP}2rCxAfjL&qO!>WcDolNU$4~jh2fiHZ&=Q=6rR5l&M8G5hWz|*0&L57javtru# zIF}F+RPpU+<&{BxKq5{EK6-rRc(s9u-OSAi-8r(Sn`7&u zR7cCr1nZ1ZQj<;pG)jP#ib!fWYhmj^c&jYi7&-WDbLPJS(KTDj>$C;<_?oD>iGb;G zwqvcBhNd;(+KP4+ho=6wT|A`_oNoWqnTvEs@57{IbCN)dc4?NmGE-e5KoeVXgJc() zk1xcq>DT#!wI|~%+#Dh=V=+ZuQ;$iu;&11LF5Z19%>`+4H)&6L$1$^|8vI}T5@^*O zXy>GSw*}li)v*G^Dl}`M{E#{6Y=Y|C^j257DSPlx@mP0JTQoBfvsz!@k~MQ?%sr!e z&%ve>l!*_v{xL~>f|+e#D!^Wbh&OW06xPgF>*-XYy4fdo?JKSM2|&WMyR4@Er=^KZ z{>a0Q^Whksx~2z|$}#Npqtwk_p7rL|)}>+1j*7SmP9Ar` zxu4=s{h3STMPAJrK(C8=54U;)Z@+n4jHk4&LguOOM>tLg10s!uB_m^RQnZ4D1?R7i z=6+3Wsw1)Tl;+;lsdTal;xj2SG|f4!gn@slS22J1iA;3O47%fpS#;`3&^F|L!}W9N z4Q=vCPUWvCPraPam|^^tGBTQ%pl;z5C!0FSOscxO{xwdorXC{ui=T&tVFTG8*8&6A@C@#!TO`(n8O#yBwI4_bJudbG>%kgeEyjdT-(Rrd9JBM4crhahfZH?* zoG;TtemHs*x@xyV>rY-c{fDx4yqR)a0U>{{Cz|g{i%pE*wYk5;_2-6xK{Z}n85^%6 zfb`G(9_hp2Dp;LPGC|hs8~v+Sa9ngjl3ix}r5peTnbhnGpQjU%d5(v>Z|BjgEoW2a zv~(zV*knX7Srk$b8FvCLPN}w?ySVu{pF|}S5z{10WCnJ@90`(#Bw;c!SP16JP1GP; z{E?WL@Z-M07G=xn%2i}I>15#$tcw^)1#_8F2GI({UkpjL?HQEYIvmyqlBAJBVG36z zii0HH``a?4f7)XOf9O+5z%I5jL%;ZPXCT6@-HhY)39gZEgA)msiW&j-86UXv$dDRj zrjMD6aKql{LY(2r$weXzhA>$j_}8!aVdJ8SOew|qa&T5kw{ra{fCe_=46g=o1q~pW z4ts%V2!Cfloap~7oGTw>foELACI*J}Tw_a<(cwmC-Mu+rxILLs<-m*-Eh$z;!WFB5 zzI?d!dBBBpEC_Ohhm*u5wH(98(%N6hbh`+r6}S=f8}Y>lwoQ6Ofi@;n&U9dT4OsjS z_sQx@?Z5ICm=9kPYm=}OvMR%AB#r%(pQHSuJ51#qJWx;@;ThK(;Q|P8LMY(AOx+tk zWw8=dLCWu5bcm)FY%wc3|8ue?z+CR{PyYWn*Z&ihnu;Z`SIx^zbHFC{E-r9Nzse$# zqNMOs?gU|^@INC#q~j|%A^prf0Gk`$FNTzuf2YL?c{~#6vkd7sQ%zEouYW(+q4=4N zzfb};VhOcEe;#7Rx8eU@l9ScQ8=5Y}==Z#r^QWK-ZWD%SJijw3781Jise7$X$>VcW zA%cd6#+-`xHzVQ1D=+{e=5yXTDN=C0&gLQ{B&=vCY6y7^i}W=sa<&IzN%_3dHZ2b% zqqg#K0tzhb?Q?|l@@dtjrBS|?e@SG7+vp)9DC*h#IcqKCdw)LP@jG^(V7B8*y@A<) zT1AOb9px3Q363x1O1vMC2nS9aNO_(e{yfemB_q@P-8rd96Yx3pJMW6E($DVNL;d?8 zz{{QB<2)sa{Wjto2Jg?st8~nW*}M{< zWqMy3>o95M`c6p4aCAuw1^%o|k{q$EiPG*e>5OPqNW^M)qXIF}G@GARK$ODIkB}$wKk{s35lmCwNpfJCDMVhl zU87)WSTqOGXs9UHv$M#>v{Gc#tRGkFd1Wn@YGpD+xfH%e$G>T|r3lWJdxJ}wFn_wB zL9hC^%09luQy?hOAf4=z6499<);)a} zRW+;=93x>z+9{Rbt1&kgP&KMUljeB^(~*2dsayd1aYr9$JXadZ9_wRM$Rwd~n9j~) zOOUgnx?}Z@DJ*mxv>TmUNV}J_%%G7ty7%2CA6#2+H8WPu!yJR7VLz@sX#KzdQO-!naI2i#Udzf}YvpLH;uOZ`wLX?{20OTeA4kKIUlHPO#*saR<^|9b-lmxE?RbM zxy_9U#`J$*v_$^&wM@BW))La-Z_ao&c<}h9=M{**rJ>AJBl4~f+C)Pyb+JemK330o zAYtiT=Yq+^9+aD&NWkX)?XyQqVM~quYxwX1kSE$4oQvpcao6}lXJ1K^t986fxP+d# zfSyVrlu&$K1Wx}^30;dYmelS7#WgfphruSly+DprS)<7=b!mCddB?$=rTv+0Hbb^_ z$mnUqex5y3B%iV`#iC+Uo-^IVDW*!lB#%*?t@abJ?j6eoZKdRoCX}F_B69s`!V5=F z(wNZEU7nZDC@Kq$jWQ2gCgdCeZ*q0@o|{BcCJCT~&O4>}%0g$CN_uq!=SRo)mCK#8 z$8Mx!k=os_O9SfOXHaUbOixoG3Myd@LDYH&Yv~j z`N->kY1^3DPgUq+U1;aoOQMqhp>opEd=q5@I2#&M)LFOJ@f~~cy19SXs{o!}q9S;?p&e9CY1aN6U zGXBhM!z$Npna9VmYcVckvjn{j7l_+9fttk;myh^>E(Gv& zUSfJ`IpCKsU{?CEW!-9Z8Z!xt+b`uLe3M}lt5J5Ns{FXlZU7=a>v!j~UYT=Hb9(qe zn^V4Tx7;e|{q_4gHgu_(m=Ozs4Pl4^d>+4Rpv1?mQN%VHBa(l56`$hgj8f~4yNDmy zLT*gz`{sHtWtXGqlJIRXZcR*srnt#~t9J}-zF$M$wBOPwBS!9*)MZ4v8xUUu z_Qi*0KZByiyFRWZy|S(BWS;cbQ)VRG{>^%4JtgWxZEn)J!MM=~gTA*_OvRzo+$(d6 zF0pgh);-@9MrC*1e<@c7D0tsgl*AJHDXp|O)OR{xT8>bTap2C_4Y3mW%npJVbQ5`& z&aKxeNsI>OoaH@U@{9~z=Zr?MB?g##88jRzj$5bcvb+vFFBS$T@q}=s;;AQ_LKKz~ zDySB%_%R;_4r6nUd*{&&^z^jandM|3D~OqBGGp2oB@Qo>LzB#QsmusM(?l^O&cG7O zF`IqzZ{7;{S!H&=4hT@2HL~TLv)@?z`q=daOGocwGC@;Tq%?F_tzKLA?eV^iLn&$RZ1Z#Xn9k*SyxD1O zb;SpRG#tD0FbBV%x?QkBa>366gR?q+bTiSI%%L;9CuQXfa#-J2?<|#Oyq_xy?Cj6d zn6z89he>a!ngzyD*)*ba$=WL+t-K6!krQ!oO&9yDP~A4=g^IJ&(V00~F>JzJb+8CA z5KZpF)^=)2z)H)KeQ+jA58yR<8rIYE$}0cfYd0^;@71MLNBa$>3mryu#ojeE>*HWn zZ50Suh|BUJYV!3(;s>S=WDNOOr!%(M+_r}{0@mN@%Z8&12kk9|T-|>S+YWAdycN!( z-h=oMRR`Jz>V8EK&wmX}dPneDsg>GAy=AD+R%vd0x#sGeym-&OUXlH2bm#}{)p#Q4 zRr3aidLi+CbX-d(yJQSIQ6IeNDq~|&{*aKJQCm?=sSuOOZJNJTYb>){Sn4p!Kr0Fr z^n2DW#uIu;WB=UsjMuEQNxzVAnB7D#Ke%Lp6gSA{BW~+8BmstZnGSB(PyjWTQt1bq zkC&VFc>mtdn=C9<^!t-g+i9AMW;az>!<6zt5M7(6rarS9;@4~rUYT>fzW%7Jrmkv_ zM#RTKWVi(BeQnS)DN_6;DUMjb@$lcdfcavL-JvFL6F8+QeyZiaURTE{k<4l%+Yt&V zJ61ur(<}|s8CzwCm}8pTD}~wE3{An`1eW$c0d%;knAn%nYV@ScjOxy2x%z#Lv#c$- zuL|C(RQvWd>oqSu@YtXxgXZuEsfm;tgk|B=53?@y`d<5u#EYQQ*Vg$;G~GFjMINFz zS>g0qt&JCSu*xG!#l!r4^4Px%`PAH87H=MXJ!RMTtT)3Ps^v^gb*NcH$1f4#jRu!j zl+Ho44eS7j2(kepel)ob=TUXLnP6$%f#sM;u4iY-PhwhpTot>7utFE!%`Y%f>X`Wu zv9JMV4i0(ozNM{-qTSF$v~2s z2R(>&S;ff%#r|*lnhT`LBd9f)epu2WchWB#fkF5?lwv-OtAV1MIWskxovUk0+NCh$ zp!I-WU>T{)8o;&hK5L|s&g0T@nsRNS)u*g(GAC?3b~1ezz-RLs)}h;m z?(M3_g17VHBY@e;&C` z@zI#NO6ipwsiz4!?f9~;vK~~++xkwKSQ36D*^0}8XBB+kPy0Pk}tilIb{Y`GZP8GM9Tu>|Vu2uUj zMF*FP*REP7ME|9gXVZ6#%k^2Z_RXFjPLa+$ufAn1JC83_H*giJxKbO8E)D{2iJ&WK zL@sY&Q+OIUQ%l$6Q+;z8gwtnhww*_7q&qJx$y{wsP0}@oe~}ZPS_SKPh?AvDJdt>8 zHT* z;}61ZgQQNAO7s$_ZBhcvIjcIH-&VVa?fg+f_-g8nE^uHrh4FI# z9(zAo)C%OE>kx7hu#sr_tvHSwn(=A(i@*X-#*JKj8q#PG$ zxoem6jR>ku-fmsqVTU6<6;}cLH|L&=_cqsB*tP~l;ZdTTd3P6lc3h2rDROjRDZ2w9Boa0>U?Gp9*4Q4;u0LEmN4B!y( z-WvhJnGtj5mFm>nQW&<}1dcz)-i=VR3K}{sCd*v5v$i?Qgj{ZHrc|{n6|ih%64@QF zN~r8si?j`LhNY)b&zD_LJ8rYuv4sR@q5$g*_H%m!cZCyKLlQX!y*oCe$%SiD^>6hl z{rh?2VBS;3Wvu>Tqq%7n3$9OszF+;^b^h(P znLpZ{7tLU_z=?nYeGHbSfnh-8G?r;{x^1=AMbO)zU{BA6+s|Uo2wXJCRDb z#YcR5!Kz-G1(SoEL^pdSp=$Su5Vzvao~(Eg?EYo&z*Bv=Ho1JZS0X=F9+u8pil64}F~ zhiD0q;mu*D#bHb)pMC1X9Gom@c^XKHT`&OOoKpK^r(EHk7Oy(qdzE+yvSSWWOQEcf zTiLimkG{~dvBXQa+83t_`BLCDvolxvh+F881{0RQ-O}L>7b0l7xPWfcXy{G6_Vb^z5dBf|j>^e|B8@%7(-5)W&7; z2zC+%lP!C;C*8g2>9^d*+SWfnv|L=urv%;WB_zU(GrvgqwL7}To8_fL#N%FbUN${n z_!xZNKudsh6EQLHexxd5--DCFpbZJv{mm;K9vrcyP?cQuv@f%o^qf)w*g7~%hZ(pz zXBOTcW({Yn^?|leiV<>@BhK;^5j<*>=MTayn;i!PlUhYypmzN#DTfPQcxi_!YC-5})yP ziq&*4qDyhu(Z>wU?t&j0m0?VibkeNhY#TrtpZglg&lW4#%0W7x)nr>f)&_fPMKmzi z0A&}4K8Fpv?C3H~l@&k>s?++(-t>D`FvENpKQN_UwRhA+G|_ekf{P{Caien~dOw^X z&MJK;yKWEx@JrM!1lB95N9xG_pL+A*v-(n{6sI`kW+uJ5ccS;cMQ+jT%6znI9kn`% zHjw53j#%B>Mx*Q52~@exDrSB1$ILl~1Rg`OKvJ8W?s&z+0NDhvDCsWBTa6lQa)4oi)~H6!}RY)rw<_ zX#kksbL+%FipJA#0cZOoLnlPL8SXf-#PbCm_^pc4Gx{EkXqCJ>JBn=_-9@FT&kSm* zqv~zt6EfLU#g#*sInq(w*pAUOCrE_WI7$j=$uju#X3P%Xo9Hz~xUx#$@dn@xDFx9G!erxOWu$Bt~c!FQXG z4?knw+LyQwa|8fX+OB{!%kG3Ir+yyrKyqt7Why%?{G+i01sJZ*HIKrpP-)NY0;9L0 zgP8h#QX-p(m{ViId`EQXBOi%hCDGx;72GQq!vHg38C{42VHRL)>Z0IagHIcyy zLzb6NGfVgoIwP)(duB{j?u$pSC5)7nyI*+1D1nhyhCshKwNVot%DfUU*IPa1Cft z76zSO^_V*Cj<+T{+{$S@8#K`j&1C7IAoR~|hmSFn7OjRdh&nyc6Gd%Z;-C}ACWPD2 zmWJZFz#inA&sYT_YaiPA26~VJdyvAj47RgB2_Vt*0Pb_zI;fg8N1%s6QFWS`)a;!r z0)dxvP)p-_bxJO^>|r@Y_wRZX{Q=G2MJ1LVsZH!M?%N6a24b3j6Qp+*u8EsNe~7|Q zD>W<9r3rz-<%CqpC0kZX3pP$0Dr5wakK%}S&shoGGYeYL1x@_P*^ZM*l1vuzmzJGo z17<;%uJXG}D{>S{Gj^PrD}f&fxoV?WxYoo(ipLXg%qO84m}p#cS`xaN*|1TNc13X!e4eId+Jes7$0^8lu9~%m}4*nc+$2cKamSOyq^l zVrDwuOVRw>Bs}vFaZED1kBFeMOf$3}k;#QkY-x3tXFnlzT_w8!gH-~^B$-TQ zDbj1^QU5X250z743kcxt)e0TORkpTkn6V*pVzMD)Aoz*6Ak8x!7w$2_E9R?#Idyy~ z-6iU`Jw$<6R?ZJ2r&dMK3!>Y!nIlLcutl2mk($DuUY8x#A1-|E#T}Y`4sih4_teSe2O4xWecH-=QGi~@v&?Q$! zQ9Xys9lswsZ$J4p6)#eCR6c(v)XN$_-4TG9lV68AFB(;QRao7SP;R@6gGUoBiqW`e z>hk1Bk)+NjzhVtjm z@1jhmW=`X25ic7?r?=Uw$W>4$D}12TXfOU=F6%G$85zQtk=fGJ*Ft}BD*aIi55#GU zBcH(G+fLosD!VhA*=8Ae#N%VYL=uI!K&lZPhpcyV`o)JB^j)%T;~7f4b%b+)56V3T z?WmoMW<+*s982j2hmSOxK&4hjqcf8=22KN%Qk@txvEQP}1iJ1pHOKzPEGvuOm*~$o6}ToJ z4eB6f?2Slh9CBQq;lLA`qiBZ4H6?nJ@N)oQYSovctEI>|)l#Zx!Sp9$@!M;(=Haq4 z|9o$#Re=reug2VDbv2>ZD$p+R(NFG5hzN~tqYTg^i34oChfb%mhvDX$W!tHP2gnhS zOtP(5Zj<|h*v34v5ZVJ8`jxD~H#D0(vr@IycN?>L&bqzQYkXVWc4MAvq&GGfe&y&B zvwU(h-o*3kmB`aj|1c9QtPUseM$e70uUvTaWP1P529oNzFwfk!R=WOUai;%$N%Bk- zCb3kg+!Qh_T$O@>#Q5{wM-x-a&kck@!3L3hYY+pkQ(1Et>hw%@KaV?m=o-6)^BGTO zdefe}xr=#CrjPU9G4D@~5StVd=VOu8z}Fqjpw91%YR-dbRUs!W%@^zc{% zbHNbx%5pm8i5l`GHGY$nwC^co8#xxuc~Rss~JP*zf5yuR&cr!>h% z%BJ_OT=R399$S`)1fi0V2ZX_kL)WPDS@k>gJzj6eeKbh;6BDs4-u@7&pwZWd=u8u; zoqpr`UBe{AKK~~({Yef;cf9{|e(l#|ekNtFCS@Kcx6wj-M_2~Q{#`UVC#P$DMSTT* z`C60Lo{n+n1VG)6p*=nZx|k&iPRK#+-xrYRC{3OGFwqixXt?6qZYPC=-VVNTbA!?&A>^!u4C)`ABntppa;)b~8n+?`2a5s~+o`AUR|hh(7LlYf2#<)hQ>cep@HfEk z+;*jR6by?RB81!>tkscXb>DH-yAlbB4#$5SvAV(&>A$qgFK>K`YOlTVd;?PEiwyCc zXZYO4k8WnAh)sqNN~k74HlU6{z?1^9HxL4qIOG1c7I*y3gj@Y%MTHv&ku65}`mkVnI!pr3!^PsM80CqJ zXO8CSlU8vRVRoBgEXIoBobxEpo&8x!V-05>6=^@Tv1zkQM0vlb67}5Jr$`UQP2iWs z$NczV@!-0>?<&2NZeivm@)ZTOgjBnFRNqfJ<{Ns) zx;p-N0`}o4+upmfAd(=^F0MQ&urE-YPOm?6Qt^A)8 zl&^D;cw?TfGg;mB8+>fyYK`1U5%Hbj*XO#>?EO2^{(?b*;P|dIV{XZ5$7LdI{=T;x zFs+@-<6PL&T)bGRKRCwHLq0s~{hYL{`CZ}FiX@PPW7z4~Q{v5%4vD{!qs+}-`7ErazTuEpSBLi+bP zFa{+zcV!=_YxCoH@$32yWmgaT7m}|KuWuF>SWYiDm3bR}r|bz2Zk1aK?VAFMHs!Et zkAP)P8txu9oxyi!v1LNf;Z!1t6pLKdZ@+9B+m;PmleHmZP~hvZQe%j-2TSCmjHdy4 z{i*5cA~#IQ*HcwiZW>dF$pq0<%BKaYB1{C=p4%nmTDUJ@&j^Ug@{#dV2mDPYzGI ztJXSa4Fg;tc345|tqZFcFxWqMvHfPMTW95_wu2~&DLaC*WtqUEDN2gRXPQn>vu>RK2J4aiQh#Q+fmyta~W6)-+Vi<{m@q8;i=EPu_7Kdy%xycbI5Y|Lx@jv zeMa5Pqb;n}FCsHTP)@)3JB$(W&sM~J2d8M26$PHjnljTjV)i1-*zPOj&)v2#1P zOe-V73nI3vfAaC?!HyrhDIuu$TMd@-@zYtobw)(9Tg^B<^0%=L&2^k4u;Cwj%I;ev z9fP>Kvpu1fd9AljD<%(UuU;-Zu#Z4X>s4nwW*pWVLObmd#@+8gl&nko9+1)+-%X38 zFu$ODbX*TlSEIQNSMBQFg^ePzqMBN#mZk1!pwzG16zYjnyLa&~P6^RnyB+Po;RbMf zmsM?oG9|aay(2j-vkcejvLc(drG*OX2nM3Kf>C5?SD#u_dFcsfJJ^P{&iGW?hN*V4 zy86}Pfpf-?B<(V_r&D@KZK*Y3m%@6Q&iw%wNBLsBPTx{SgL`Ag-gQ#kNEwMqW!oHS z_h_=+4Ir6QU>L=PYrNwWz_@(A)}j}7tPwS^zK@2oIC|tl(nOdXrL~g~^ji9^g?)>DcC=P5U%ud_aP^Nj z^Kv-hAv%fc+lky;tW%#kbfa=1w_h2uw0$u-)Sl~x>rKbJRJ1-K1tq0PlSa-v-V+C8 zb+>0sC-f~$aB$cma!BLY*dJS?>c4gIUi63J&j|4n@GYe%eEmqzr@flicsG01+I3)M zQ@J+|vl?wir1!kdcJcqp`7s^m+nuy=Fn@JVIgN3`Yz)nF*Z!^dTM_T+cf4O?<*BHS zu_iwpbk<+tX{I~PxgB53{M=L04A|68#ORn=1@s@;XzS=SOtkIpT3JjR(QwXOfi$X# zE$!Hb=2OQd%-bB$7EWWBtttSND)wl(0(bI_Ypa`!vmavgVvInKbLcL|#vTT6wEzI8 zTZF)wJX0izdR6)6IQhK3WJOcaEKL2*XM5~(B()_>zay8_gyOYXLmaomPh1l=CEd}D z>LiTay=P=&9hp^5|H7v~=rwfRin0|Pxc{rUw+xD_i@F9$NFX@DB|w6^ThIh|cXxMd zoZ#;6?(VLQySuwL?lPU{d1a>Fnjc@)%s11&x~op#I&$y1XRo#P+7drc)bDYD2QA~m zx98*i^Za@Xt-q;3sXsY#pKZ(q&30dslMScv&o0s~upoWcte;V_L#C)qQj0m}PvZtA z-np{k+|-a7Ln;B0!c%!gilO|*&TU!!bxG?cwQ3Q~o;aX67^jYQzk4KBzK=&KuumG z^RoNl^K`q?!~;o0B&&N)*l)?sT;V!J6huA<)J}4X4f=9MFl|VhkLVmt2i9PF3*I$tZP*lVj`upNGNxvs5I>dbJYX4)4LzdWz26eOlrtXo%OzS4zaWjrd;1kKCBB6Nnhs2f%y zesoT9hF((sGP$s6sIak;J;>naJ|hmJ1N%ZP*GG~Y&;!$cn{6=%F^7*4C8;l}J`tDV zumPQ~Qe4nRDgFr>51MH1qHLh76Eyh58b~-~aN6$=HeZnLGW2wHe<4x|8g~(9pEjG! z(f1l-?EzRiQkc15KXQ%yX zXB8#kaFBaaWA<$2$ZFjJfuw#-Qqq2HDdWOytiDzq)Jkjk3GYrn zNJUki9)^XV5(Hyr_A^d~Nc>y*Ax>Qmberc78Y(?L%fPmL&37xXwLoS^;N`WXUqk_x z`V8A-)yPNFm?w!IUPgm*-bveI_HO7lNYH-2(v^t)SBw>-S~T%KF*`rZX8OqHF^s7q zRQ;)ZeL0hdqr>bq*BeZ>#W}~LbMtX><-K;M0n^r28qTuhcE?{C9o`X8CK-0Hj!(^^ zlU{Y~-m$K77|s;W1u@%wvn9fUs@wJhbb_)-MZ~{ND7gFL8Z(zY+)@PO0`>AzLelR#1iSND_wMj`@kMCkWX7iIJ z(=z--eobin3>O({Sc1xYNe!VmAsuBiW|6m}nuPG7Y5Vnq=)q+lwk_%s^0icQILoaG z{hHBQOggTY#}R&XXLbUu!WwH$DGHfPvivk(4_mC1@p&V+j8maxViSst^l!rTPfie@ z%et%7grg7Q{Yk!<54*w4Ec6fK=AQ`a{U;W%29{4B)$BAJuwJCbxs>=S8FDmTkS_aK z8O|PlwXB$Jm>vhsufFLmhUPj_7z;4umzAg3yT9QHZx#CL;c@(g=@-L$GN2!&peo0M z5sYq&F(-L%^rwg8DX!`q9F zi}D*-VIEaIpritnYQOn2Co!CJoa1hJ4VA34dPFGw_SI=30gma{dEWImQzvkWx zqYu_!B7cq?_)G5x0|1^VZ<5AgRNT*{rRS(eKszk_aE3*yFhB&+;MyQKS=@S5gV5yp zyrAF}-+1#yA>)EN9MMsMVc4T6^D9T(pWg$gao`meEO#5^JY>qM7P&m@DE6yqQzZ^F zYRLLxSuHu&Bo924RVc(itViP?^u9SBm+*wvSzr(q;12LxL9l` zkZ(=!XyfBQs%Bwx^o(nsuUN2NdLQcxWn?Js`8_5$$59ep>X&0BC%q9nucYtlGYFOF z7eHvoS=lS)^lDWjZf-Nj?C5+aG4Mo4MXjU+nc|;pCZaH_PKAyvm_wmzuA*UH=NU?> zKA@0-1fRisCP~{WfvPUeGSrQZBZjwxMv1p)^fBC2Du-cgZhl;DiN#PwMIKIZP+iS+ zfNTT2+w0VFhv`br!abu(NQx)_z*XCXs%=&Yoe`?_@0oiMKnXWBVnSBCW)kjjE{W-& z`WW4(@@rO^yqGQ)W^}*76jk>e^<9OLV{#$`i;T=UAz>m5rGP&QQkas<$`p_E`>Z8qMHuB%S!nT+P_R+ud^ z7cd7{(e3-rtR5$m1gBnwG$d%=t-gqYV+F3=DP$E=Y{b5pk2s(0mqBW(RLrx(l4nI# z2Pv+tF1l`A2%IIQ0P0G7OUGsOclE;e%YpZ#S3rv~v*u}ooV#;`enV?$t#2OsN;!a6 zg*tuLaM>ttu9P)Be0=*94{}+rRyN%uC6ZW1fW&w=o|TKF?=q>|NH%p+W2YhYywR|x z1536;(~_-cbJ23axDdU7Oy9xKBb=dCJL{Uf_L2vQS3Nt$*}xwUI^4pwZ+oqEwXgZ# zRkrH^?SUnMyCud!}`^gn;P6ewGnpFZ5Z(Ja#NbU#hp zlF{crtHd(7bw%y>y9UZI2It&-BG3a3MUm_Ip;zlsbQwj)!4l}?lR~||KS4X3#~>m} zDrH!3o^QK&V}9akw|gcRecx2oAIT=tCPrgO5wW@d_S5eIVWZ;iKu1B4XyhvE`Y`mvxnTN35QyULwoRp z;mCH+RD2X8V~F=ktUaa@@TPWNja_|)UP4h{fv^0MVC2VaXgz7kizk?g&zP_d6TlTau2vE+-c^ly<^xNstYjVlfZ?Q6<6>E#2sHvXX`D1?s6 zrhGfT`r)@^5um9dji9|*CM;$SjVbr0S`|G1L{w$BiCkGXm!kl{ft6(4?}-012DS!j zZpg8A&T48t>O;l8O7rfVMWgSbk;a0Y(H#N>@q*{|sRryZ+v ziw%X}T;iyISeWAKGi=7&9d#*#J@l4@O?7D^(^m6i+kFF?(W3jDVUQwF<@8_HiK<=1~hD!**N-bxS_ ze@Ff|VE_&J%fB`SuwOnI|7`;C`IFDT$xk0Y{tsm4f8S+-pjIS=Bk_4%uEeeGrD~Ua zz==B$5M0B0)rYqyJDsm*C&uG#k(Mcc=ib8phe#R3;kSv`*C^{{zD^yAOEs2!wc2Ky%xh-ehSNHM@4+YQd1oVEMcrc~1yV$J# z+P5{l$|oZH4DfuC(mq!Qm&VmfRrFYpd0s{GbOaasbK>cI3Pr6CSnaJa_PTfi4b)h_ zsivaKx&IwE*pmS{?e$QYH$*6rJLfJplILk@;w{syu+BMSO*w?Gc3u1B<~1lqh@Wn* zDzMDujn3=EdRe@9cK0xE+}N6&Qk6#~ zxO+MIZd_i+n3sK*%KJ8l)H$y<9NzKnY2Ca0B+UB;@^Z^R~J+V}=c8M7@DMF^P z(41bc@82#)v|on_Ue>ajF5-6&lN*KP7nLTqJn|!!E#_%nwoZJ1Q?NXR@*Y||t}1t4 z7j8W66TI|Q8q45UG~~~_a&n};ymxpUBWb;LPfR8*cV&eH?xaz0^+1qb^Y^Q6ItWjxY{>BixtV>^WT z%F4?}cM&J{#6%B4G(P0dnoOknQm_m-<-I<7kXvIMx_Hq4k<$-5F!y>K*+|Fb(~pCE zKYL_kE*>9V9k;gi?*0WUZkxtIls=xtA6i9AO&B9r7$ql4k*_a??da3)b=RwL`0MXo1#xnPZ1v?An&6}K`w{QkUE_P2SpM5_<=ee` z?4j5_cdK;!aOm>=s~7hB+jeXHL`Km|;eszYIscR*MM!Wzy}2Q)!EiLG+xpYRe#hNB z=tcc&J7=(7Jvk1++P(Gr6)%^1$mjL^&#g0iH#Q@e z`yMzyt-N1@5Z*pz zq;nCccHBpT4wk`suY~H7oiJ`|1k&1#G14J{IGh=lZ!T7umi5!wSRhQ0SMBZ6^u*hq z*Yk73l!B?H;clVV%hj{>Tg`#_hBY1M)!ae#Z?qzY_~+$vZZFs4c%%&+baQUS39t8e z1EK0=B1Npf-R%nC8a+sRy$F2YBjbJSyz&%KI_KP43ejbA^Ssy_2WE1Xy**ElbSC{K zm}?*?4taS3-%pj?AF3TTFe4R&c)qnY@0J#K1$HXY$&6^0v8LeZgx!H_jlX~EDq22x z2WHlvkU|3&&4@QrH=cp-m+|+Nw)vSJcT2e$Vo>7QKW3*gJ74w^z3wVM7;V%}c)dOn z;Zw13u%n5PKzrS_zn@{6G{k2L9(4?5m{a_-LF*9l@Xx4MLtENhqzu%;{kvDXTgr7o zc9#D`W&D5gMwKh-#N5O(qiNC{sJt zol@hBa6iYs22%YAv8%`D-D5>r1p4DrBD%MiPggxD{c28$Y?Dc+p_k&s<#@YzOw{6; zI&^L-e;AUD&>!H$nSG)w{%&Z=W%IH^*M7rW&jAlLz=TKkHYQHz(Z2ptrL6SfN7!6p zL}Lp%c*1x{a876ZXB^Kmc@0`i4-yZcHr#-zan+K4Fc+FEd+IAPrD{;_er0!+0&}rX z&m;1b(}eatVq-sbij95Y-y6!6%wJLxwYASB^2Ic+DfcGyZ7FDgO*Ms!Ztna1N^}rl zj4~`%`&+lDP(N~}f{X=)0Ot7_O4!}>G+QRpxV$g1#m$58?n?|x_s~~afzm&diLCK@ z%B>qsXl^2s&8#OD7o6yM<>zZp&0arWGqiiD=kVfd?(5mwrl2*H(JbS4*!~j>NCz;J zx^7?@vl$Y2WgXT)(#>BQw*>fvhJO!@X0T?w{L_jA&Lmzc#7m>-5xK7vre_JAnq2Q7 za(+Vqk=`%(C6ML|gt@V6mJ)s4u{ckBrrTl zG^+2a-@GQP^-XLy5=BO>=vG1A)}-lP(JO4=_RezL4wnh9x9f?5+(~rzjo37ORIte> zVsswl^x1X|gAw?gO9=Z|&%qtNjS{J@$@`OmwV@#${Ji0ZNprG~K(Z~aK|3kNtKVP| z+-YI6v(<9>7qGD5TR7PRtr4L1^Z@ERw8{(=WL9Y>cv#|;e${WYzs(u5(U@FQHa&bj z4t#pjE6vZ+2Ug4*brz>EQyxw_JF>p9>!72+0uQS%x=w(4`Gqc>wJLOEZNS8Fss6lG ziVm(sW-9>0Q52wRrP9*kZWcq|_Whz2GFF@sHmcjBTuc9p|48>`&8MLkX(vC^DgVucpF7XxN^ zbu@|@^_krsg51bB^;_WlP_P#Py(1Lx+))dRbwq?!D`4V?^|iVQD<+@t#AL)kTjS*909J;^k$C< z5@tt^i|;l(Rq4g4?42VL>8QE7WR8oAF93eJbZfLz z*`U+i$_$T6PNC-G)a4Qj_IdNYw|=$7ButfK#vAgaN; z=0Ua=Us|xXw%A-cE3lf<%CO499xtPm_UMsSwmUSx{iCjB&&@pWjlpT{E>sW512YIj zX*~s0?;9J~o4RLwyW={pR7!EL?>byF*x0!($8J}fv!gg9ZEb4~Zu~|1mu;rycfM#} zZJcM#WLJ0{b#nk<+Sf2uSz`E6nT9eJ=maJ&SC$s5H?VjX9C=Cr0M-V4l-6}Y7g7!L zdd7}7uruuZ{IdJ-S6tllw`LQbNsSr3OgFcEClKWmlq)nsV<3xcq4eR{$_>z?5`ikB zWk11Hc(Z3zkDI<`ac#S|pSJB6U#&v8!wtTYY}>SaB@3lk{e^9jj7n)6GP`)T6=XYh`MH&=NUV8m@&LPBZ5C z+&GbbN9u?;QO(f~l3Qqnv3$grE)4X_<(2Iy?N7mSKYP*OBc*}Q;6sQpuE~e~Ijp*o z0^m*wd&obpV9?T@SzfO3IH#fOyg-N>zp16Ma;r`Zr!>)+Fpc(sd|XzIKxkj~Z(o$q zI8>{VHH7|Lm~YgWeDzsSLjANMX6jNz&U}62*p|4m{n9AOffdi{AEr#z@(jj8AZru@ z&B6pwt+DVCqVM_Ky{KyaT)Fy= zPK9i}=}&`2d2V&CB)+@Hmoq#yVSe+#pH9`Sbbppoa8fyXGXRBg7NwMlEiL_@K8N>h zwDOh&tNB#R#a05eMUW#R8cy$6m!2zVKvhQTj%0fqhzRj`06Hrbn|T(Q?pjdVHC#>i z;NZx91nw|Sq+;y)IzTFPKS5~%^Z0QgK+nZEqj&yveYx*SitH&6nv65$&f55SSCdBK zL4!@e2;vV5)gRoCvtJXUkyFuPyMwF0W>6Xqu0rFOt-Lj026A5He}8-da5@|RmY^~Y(f~o!9#&9R-}3GdK{Ok!fm^Nv&L%S`miiq7WGA|6)Wyk ziYc8c((BYLNK)WMnaDIb{Tpn}P}2MHD$R16f19bf|SgD}@1Oszhqb#Khj~jTLD(`j^JCUs(|oS2ZOVZN#gnV*kqi;*rBhXQ{f zr1&~%mM2aun4H0_;?%TNmiMRVs)s#u0Z`{_?Q@8H&l6U>E&DR7&6CL{dTFyYXT9Eu z^1AC*mc|k6yX~C&Wfhm)=iMPvO{cn>)o;nxj4$JqTBh83fcacC>bl2?!{?&F!P>F9?s12XA-bVlx+kM<%;TP_544bp^ zMCpv>@}@J9Q!p;Ck6sBs3ghoZ_6dv|alLFxm|K-qPD>)Rt>cOZJ+0wEk6`jdJzm%l zoUl(W6Q>bez#OVj^+OUB(oy63eh*u8-P?wzrYSHe!NQZ8rIPxB#{tVImEkUiK`K*cPJ!L zTUw@J5YneZ(0GncXP+I}dv-3@szbyNG}}%PDcwr)?v=?3D9$GP;cul|gJEeM`jxeK zW<6Cb7DYFs!lq^Nm&<=sRKzn$^DX;xb$Sff6&-UF|1e$Zu6X!-3?ut##$LU3CoWH8 zuqP3N+R^Tzz+Q1oPXJ6Ib%bUh_icFhB6K5M*&z8b5w=4`0hAC&2%&*#EFbZ0THyB@ zGBPl$gu$r@HXB|K7bM!fBMp2Xh3_@~XCDUBKZ$>-8`&R{Xt^o|M=DupI7i&LtabJC zoaFwg*JMd435@&=pne1+`%5yHbA^=K07Kz;;2-@@mX#|)pI)kOHPHwQKPPA1F4uE? z4apk2J9W@-8xs_q3 zbs9Dt7ZU|w_y^XWEwp=X48khPDjAFtBO)q|h=NT+$Ala+OnG8{30wUnI!Lz&4zCdQ zz6}&HR2BfR^23MB_vuRCtBbtbw@AK8HF~Ho7k5 zmR#M`rU{^4=VH|RKe(t8n9Tahf_NNv+gtPlr46SOoEZTF+qa1_k23EMi0 zKx@UTEQZw($9@L$1;@PRdf!&vl*MmFA(vrdoEZ(zA?%ROSBCWVns1VSa5dtMT*e8O z;&5eWM70Vmh15JqBT)18?E#um`@_a*iz@H_jnF-Pj`#p4=-+b|MHN+C$4H})5Ec!A znLot?14*f*8}I;^ZC!95Gqse61#ghrpHSye5=@7wF0TfgpRCf(pv^@%^HHp@Nv8g3B~zqaxy zZvPS>hqGjp-4P7)nA?0C6>)p3ZE9}yoIvK*Xr$e#Y>DjTuxM^=;xQ$OqDLJwI5W#g z5GqnbJCyU1-s_KggAD`KN)%{N_U@Y(D z&BXP(<_6-A@P@I8E7e^V0;1Nnvy<+oEk736IWSy#;+8ihGNBz#>(q+(=pyqxS;FG< zm*^5F=kZ?m`8hHdHW(bq5J^S50J}{4%$bCSLpd_T7mlnMGULK?)vg<=Uq8aBNWP z2v&!TmaB`4Q%f}@s|yGIW#Dk<4>WwhzkCqu$N%_(@Adx{=`#p?*s>2VF45)Xc5`xe zI+8Xyk(diyeTW~)t&MrQ-*V-|!2ijFBbhyMk&}+#csF?gUF(y>;CiQYQb?PLB)$aN zau9vZMmgU$)YkYRUV?iUGo_8N;xMEb8P)sra*0DkT=e@yLioope&CyaWjmrQo5-*Dtv$@G}ez?Ry!}Vdn4IFL9)!(abpJgO@E5A>|0+E6rr4Q?t%2BGSZ4o_wx(#Kwu~* z_3|ZsY4}w2WgJdw^6+6;lSL!A7yyvl)0=S_&|0dtnp{it!#3YeWUAx(eL3)LlHToZ z9{VM6Vk0Aga{1T2oiukc9(qD@bXC*=Q}~pX?xdF_D;0KTyj5qV2zGGIVwm@1Q;a1A zTyg^A)f#$Qpfmg*X~iu>^N>pl3_AOi!&?t3*SP^~$`TFIXDiIuw5ze8lVe3@C?cAH zDOE=QH8ZgE|=q9c0A0y$CoVY zu+r0E{9T37eK zNs0}nF6e_0!pQj@Ow0cPL5kOKs<+321C$XYuY{T(^sUp>TQcL^@TUup19u69z1pFh zD=i*4>1EY`ooh_j=()yTP&GL-ILA*d8Y4Yr8Owi6tM3DZa}%tS3aTjF)@752wSONQ zM`uJOg7O6NaSuAErm}Nb3$q4X>OCZKBtb5S=lN&@J+{c(Y^<5S*4R?=mZ^S5@p*2OS zxyCDGDm%KUYKv(d!I5qxE6nYCR2kh`cke)=$1l}0A)i|zfv<4YcJ*UYfgX($>gXic zkp*k4sNsq9VuMs7=qhipIaU;0S6b(=Y7kuol)IbMD+{AJ9RYnJIBenn>zw}(R zi?r6&#mH1`OKWq8dGH5u>xz_>sgpl<)L}ES0XsUXkbt7GV{^L|>r7tFbZO}$W|;mK z_01U-^vOj_57TcWuI|Ix9ZlKiN%M$V29-l^}*5E+^{96O5E-^B$xJd zNost<#zPNprMl8O%@2ykcEjf=_<%%F#Xj?Ie`}|d>m41&;*u{i>fM6wNBG`^AcZ&Tm zaXm$y$gn8!#7Q8lgv&oFyaS+37OsZlBtlbEyAW~qq`4QM!WI?a_nY08u$>mkhJPYk z2~|GVN*L*txeB8#W?bXh>b=ECjn5lCzTWCpNcN(dg9}LPi=~vT}5Z>WR zyZj*Y1(w6UK<+tZas8N)5p}3N`%A5^uCVBkeC_p8YB_Zgu3q8d=@-)BlxDNgrc!>{ zAGr^tFA=WF<-xcr%Tq=N$?(F0scVMt+Tr3M0mbAjdTDGqQu#|}faU53Y8;e4)7G`4 zoN9w#8rSlaGBMP|^N9)Qf|Ycfb8W2{9Jy;D19V>O+v*~xviXh(2u?(Jns$YX0eE=W zDgB>BqCQ-}h!8-3WINHEnB7YB$esjC4-2kPaz{gO@7;E-2 zEq^C6_h>#;pfO}J@pAFPw7%FWnsRk(Z$o@~dvFW6yeSNY)PTQqn!8%Do2t;)+}x?@ zJ2})J<0X}~3k_G^*=O~H|g18k=!u1VjlO!&BP_;cc$Xaf2*FscRwX)kdX=*sWvZL<>$#v?7`!vdArr1fk_5MCgf3y2wzd_rux`ZDZ#agv}BIAgy|ez z9)@Dv4zTk)dc2rzTQj6;86TsgxsFk>RIN_XvJVK(MuO_+4VV#xU|spYoNE74wGfe& zlCaL32dV%3_diuAnMneckMhR+2%fa|c3r}4dORM>^~`RqJ&J_FvbTRIT&5FvEV zcyt4=e{uOS4H{>1KaMg@{1S$NP@$W(uB)#n;Jov%_xk+zy8RYeKo=Q&KAXE~aqViA zQ82kymf5HGbgbOjaCejq`~YFG=*pP}z4rs&TuGsc83(L=_;WjB!c42Yw_F$qF4tD2 zdva!jzi3x2ovu|G2xs>J0@v3y(s9iS=5IHE^DA3iIm4j#H5A^ZG`^$5YFSlF6$VoeXd(Myt*5#-FKz-Jr^-k{2Lt`T35@>>tbeEtzbOziRij{FfAJ6I9LpJqoQ5(B z7F{CRrr&W_haWxME9N#MeQ5nu;=F*RCGynT1}w=4uk@esC+>6wE(E$RC;-fwYBDCn#z2 zv@T~~-wXG`!Icnd8Zz|@iwV8pI6ZwF>1gsnZ;);bW(AXC5D?_lI0Y3Q*(tJm*-NFi zQoSPF`qUJT301i>gis0J$DBy<5Q7DsIMHu|{qetYC7}J7W&76C<@?X-p`o~&i_S$5 z+L}2Z+G(hLVe6?~V9>z(HcejvYuwytQotNDI4UlZF?RHX@y;b}6xN5+mezrw9Ha9{vlbrKX z9@0ORvbrqu-IAI{S41^PTH3j?-+s&wmm1v-obqp`V9JA*f|DFVif+-TG^U=%!oTB- z=O{?fWRI2o+j z)tyhVB;*cyflvX3wj)x;qQSws%t?cS17vNe8b*?E1s3IQnn#xwcM)~0o@kNA(B_;J7>N77nc3&KtJ&0fLFB*K%*rU9&DBMf! zty?|bT+Jhy*G1sF@v?Fk6~sw9<6M)G1F%1WnY9Jk~G!=Dd%> z@(~oJZg`@<^3`^X$WN`>*$gY3RM=t9-S!H-DwBTvDtfJOyC%u}18uP%>F-mChMd-* z9zs73NRLk-phdeSsp#%IJPcx^HI-mR`=+n}3nYSrRtsO(TacD;aQj@|H@9sErdII{ zm`ofjynI8AJUk$`n)uWt;k`?%`7Av&ld+mOm~o;-%!|#X+i`JmGBrUE%RoO|3D#UR zymZWIS=+)jy)Tc}M*Jl)CClxkw(fcFM9~!$POTx#)CCb8W4-xyp+m??6Ou;t3`OZg zhnrFrt0nBFjSR}|K;_S)yJhPqPJ*BfT_MCf^k%b**xJR4%H${s zaM-wFi_wY$3ttfAjr0PAo_R;n6qS`hXA92GHK%wF0r+9WVk!wuAidIthM zrD<_%XBeGR5a1u!@zL96>sy!Ozg>B@B{@ zgkQ7o*eRY>_PYx4FX@_3TN#s*1#IX~9ovA)%lGL@ZQ~PcdE`Mk+v^$8MWYIJ3Jdk- z0TZq}6yc`Q9v&nZPp^B~U#yliPk2`u^k@Ojq3dnuLOGM||o zS6+`z&vpakF_kJu%0h7exre;IR$ z$ElJ`cQO90uxLCSV51exyvMFMYc{oV(^Tw%vUpt-|`&X>>Xl1vx@4v9Ux+uc&4q0@Re z--!(9eP)qW0t%*_zolw8-3(CpG4r&8YNhE^4d6+ls)R`$17->s#nOht&4N$EWU6PB z9Mbg-5%LH62K82>Ft!=0dy}5scyLh8oS2um3R#v%VcB~3<#_MS6=jEajq(i`V{)c) zgnB5@Y%jeZ_mm+j7E4m%L;WbOJEndRG(d&)(xH8d7l@HnDfsO#PqkjvID{WQpn~yP z$ChHFAeVx&yr`%lJ8yw62=&KheZJA;=4qP+lU4q9o@^|9ps}O`Hot7nRMr>y9-Mw5 z*{^-824ZR`_I>^5j~UcswQys;Gt7bvioz=;3GTFqvbCif!^A&rb%`dvF#M*-6`>)W zjuXm=q+Mr^-r7zx$u&iY&Lignj*Zh%)AjYK_L=;$#ScX1`1_*H`a?b~DNB({5!c)d z=<;t+1_5TGgQqGEx#+g;mfPJD@eC62l0f!1@pC}kCTpFW4BJs*LuNt!x|K0BODik$ zrdNDRHp%Mf)65#XLW+bJmPntUi9>o9;&tKCKdl9ZJwQC=CA)BO=s&fSmCO{|2J7^q z=OvV?IGJSVU8;ppi4tQmLe~aWsLV<=SLd>$Pp$zT@$Mxh=cYR^bC)BvY2S6ijIC*W zD;)(350;4c>zIW2B;&^hY>J0Xn1coVoS!+WZZV&=LWnn#VfRk@TLbt38=kHE#wO&$ zA#^p8@8lM{|C~8K3w$Noav42bH6={EpJ?K62WDlHFgpb^>SBK;Ltt)JBghcV`N6bo zqT-|@KkXAWPfsEkc}kSaEVxG+laBYUV`8$kQN$a7OBI$E^VP+F6!ECUCWdw0WjrAU zUN|uXMdpBvVD`fql1=k!O01my2SG#LP}Y z7P5Oqyov)drFJ|`8rXr(I^xtvxAq><8sW!|XOUJ(O2_*x_~zYpY79W{ZSE35>+jhTP(oFgXDSoBVK6%I8^` z)S3Dxdx`j6i|;-wcP-+XIifU*3O+KZ>^@JlvRds`;w*6vM)Ku%SONuh| z#IbeWFT}Vpc1*jOeG&+B6>=`AQM7g~5B+1dVKFX@;kV0@Q^*NY zp~|MUdbfMf@4zz|9Wip2)eNz(e7e~UA)+c1deC6iUf9MU*LCg z*F$R;hs!C)Dinynv7s^aj|#~r!5UR5o;fKRYa8g*?kLw_YGvz?%y06nD#g1=`B}TC zRg{=*XnV&vTaYtT#Z?^4N5T(`i<9h*Ip1LqPP?1%$oGGVc4uSA(itS1Y8?r%>feek|LX}m7vKBzWMhZIxVuM$JnviS^riE7UuWL;_9f3xmnxp6@BAA7MozZi$ce91bHdsJ9JH#8 z`NJJ>a_|5SCl3sM5`B3oS8oKzflC(at&NxJ8&5k99M`!7?KKINT;AXbfW%##WrOfk zM}>f3{fyJV>2jsu=m@Ul(~S?9GI4NsKW*%My#;wTb_n#K&ix(SmZXQ~f8{a#MIynU u|G(urJ-&k{;{Cm@C9DnHJE*^*10=*10)O_QOmXqw4vPv(2~_au`1~Jlr;(cg literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/15-vm-first-launchpad.png b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/15-vm-first-launchpad.png new file mode 100644 index 0000000000000000000000000000000000000000..3f530470cdd67267e40d79b651270536997d73e1 GIT binary patch literal 67948 zcmd42^;cVM&^B5_THM{;-2)VdLZG-i1b6oqcP(zkOR*v)IK`b5*Whl!9dhXNuJ=DU z-}%l@xz=9Ud*-&8xv!at`m8L6_JR1rt5>hk6y&AVUcGwD`|8yjd*nASPl{Vy&|kg6 ze5D{Qq2Zl#1V!>!pIhKOHFp>yPGcRa+hTHBk7DTWI{NsAjW+RJogB|GTESSm$A4vK2-Jl6Vh%Vx06nL9SSH8{y&CW<+wLKZFF)8k~2-emeoRr!S z>T;6ge&Uwzc7hkyw?XwH|3x;jJo0}a6cu^=KOl+x&gwrv^)8s_ANYd#riBx%7NZF1M0DTXQ~ zte!D~v(ul5f+F=#{40~j5FYd?0-8&Dg|! zjK-v8i#eG2|EWBx=iFcTfDbagE4S_3`a zm>@dA6lw4L)}C5Mq>AJ9#|IPl*d`A4Nj^`+x0x-LRyv)+v~q0|(kPAr)|ol+8UrhL z&JmNr|LNAj!$U#7&0zi;{>xrxFYPoyW~j&E?WlMl{-$%>NF0}Z$JTUWJHCX5|7JUQ z#doQSWF%$pztvf5n=xFk zeWT60O1AFG(U#_8QWJr@GonO$7_Ms@N5^_}aJ)=gOPe`zzHw`@#d||uZF}V5&CrpR ziwUtp_tI=LE^#qj-gwcp8kshp)z8Jq%wO=J^3gVZ_^TwDR9apqBaQ6GS#p3dB?Je2 zTw~wR_1gM+%;G+}>$}{CJ5*sh;qIq<@}aMwY7(i#7$hzX;lI5k4WECu&IdhkFNPI3 zqmGQyB{6ke62hFEYD?(C)yoM`arTM4;9%W_A`Pu)%S_}TX8kKIwlnutrfwMYEGRGI%1LXz=9)Cf z@^`GPyBGfI)0_%M-YJJ#(CHL7u$3!;rz%<^b`Jr8+v@50rgJ%HnN2^DV2t>tj-VNd zn3(G0~35vz@# zi;yB`s@v^`+Wg!wG`i@A7(@U~c7==Euy;Vt?$TV$p zUWJYrDAwhw0x8C1wB&k!cvSnE|EyyNb>cuv;+%y(<9io6Hdj@9gLU*uEFso8n8Ay|nj zYgQlzeZotA zrc9L-)#TYZxAYJ{=rE}b5T)M4%bes_I#|-N%GR&_Im7YFT3`(fU1_d*FX+7cLimp&T!@h?_pxqmKYlo zhvZK?8RUO8c~142KD4kuLeIarQ{L|Y|xH&a)ne9m7e!xvYtEZkDbvl zFWstJ)yT|QNoYik^7s(_=q_%vblZ?tO7Qva1|RA-0(lYSt|aDABNa@JiBl^#{E<;$|^SD=g3UC-#mY}`#q%Z z{Q!nw|4EkU6|t4Yb$AKUo6th-)i&;5Kjd2BBhj*E&!I9h3m>Q)bXJ!@G4hgS;zGh7 zRoLLQ#fMYFjxp)-sz#lHn(B8BSD0+o))O12RAf;-R@A_;u8^K&guBf0ZfD*~2V^xc zRlkW~2$HGW&ZtPhq8%qHWspT$l4_(%ud!r32ozlZ0~rRHz0F(rgi72K!ue>-HJ3{N z``Bp<3jQo2$4`nMevjr3C^q2%Fw>x6utgi}=sS8Lg=e1iaDDJ0HiwPn{?0A+-~u?R zDX3u&$C*+>_m%H+ii_Kd2_214xnin!bjoDDfxq{{M;jjE2pY*@UIppKOzc57vlhK$ z`dY~)Lm3-08CCj_)nD?pm4GPkHNorQDM;X=wEw(j?(aP_?|#vyJ@uv$1JYNo0tMTY zM-tfpHmXUjEmaljR_{@_u26p;31j=H|Fql%U-?qA7k;W6NgHCFNi}X1A}n7(P(&fk zC+m|U8i=*J>AnXjKAl~b8d`M@&e za<@VY;X=2&qjIBd#273{)#tf|a<_t*Ee~`NPUbvf>E2ANIEf2Edx8mvpv;)Jul``f z+x|AgBAlJRt0$38+U#eF+IT+GqPEUPqPOL(H zLPM>jzoekKyn(WX(gp(R^VITVvk0qh9Xz+xCLqT;#Qv6QjOXP=omKzxc$1=4j~5`y7n!>6H{ zwB10uhc^n`D!(4ad`n4e1s}4r+^ro^Ma%v11Q0Ws?E7o9eyac00OFYAF5f8*L$3+x+b)|9nkZ2}s(L zVv-fjbNLt<)+rL=;|NME%`68kS2H6Q9RGw7zJb2^C zazQFzBMx%7;R9 zI~5EcGvbbskm@1O8Q&y4I6g-n-c1!oKOuALdzJUQWqq-2kI9TO04lfIxF?rTLJmfe z!n%EpzEG;qnK0)-BHCa|E?uPD!o{5`aor@xVSLeK!0!H)Ym>Z;j02JuHL-5f7- zGs!3>Alv}XwhNcU<*1O@_6d~QI~{eF6}-CJ{1OVlX$9k z!(L%h#Ns6a*g|F}@52rdw7^fnkKE);K;jUww4kuQq$Hs5&f$;HUAp#>DRU`p2?8+- z@bi78{GgJ(F2sW!Rs8we==B#K_q#6Lz`ETaEujUaP@i_)iMMYZM0kboiFhXJqkOvC z#Bi}r$Q#s-*wteH%v6~t_H-xH(UiT-ojwg}JA6DwL*L|FIL_0`uUCw?(HBmOdDLdP z7MQut_88An-c5KDRr6eG{vbn)^&}YMrRt6~ zKy~vW1A9?9^yvim#hks$c&GR+i^N9z`lq{NxO}n!X^%5H zYG%9i$8fG5xi=g)CPl-)&BjTan~iKPHrk20<+FeSp&ZKZ(^EkV86-&iE(>?d>x;G* zGNqoRKTjmSrDydL**E^BRd{cp2$S%?NU1`m#pCE z;83rXCjcAxvGX|_5!PrKwc%=+w{w58hJex;>ESo}libfhmb( z|Gjg-5s2O$RwNuc8qRRUi#j_3O`Fp%gqPj$D0sVTO+|g$p`;dn`HfIh4q}u+ofBBk z&7w(H(aT!#F>%-x?esG9Fja6=OGI8p}e1sSM!M33^p9?v+q zIv*C!x7^5b(n=G^4VQclQ&g4>tC5$1Jqy}X(>5J@udQFs42Wb$#z40}dfJRV<%o3l z#$6*|Wv8?A#>8v$G+0x-!)MEOtiQ*YVV6zMw}+YD6+PSI?U)~8MC7}KT5v>`%akp9 zU$xT@VLg#E+gHh)0sH-=9dMU3=wVE5dn$}VGY&Yipux}y+G5jp@2UGElQggtDK?-G z%+p4onylLPoiJ#@a@Nk4g~iq*T}XDt?g(%{l0Lf{pb z>38a_xmoCQK{0A#wzGm5m$cc5@y+h^5=?eif|7uqJh`sv?9^s#tO{Fn&#w;aniw`lQ5+ATV$ zTh3u*j+;MX8}xV3Ho6v8JEOIT_BibKIySFx6+#aQ=E{SfjW((*Tdw-T|J>H&e>j8~ zb9UY)WJ{MW9937`5&R=+42UB2ZD`R>NO?k0l;Wv4^b(z_?<+0$h6x2cYpa_w zxypQ|EjpyxX=y=we?56c*ah4`#OQveC?UAv0}*!i@DCD4rugW2gpIHXfm(PvrHAQukwH%2W`7rrw@)ddvR#4=Lfsi+Jt4Zq_pf zG$9B2iGkIy$%tLVfNx*P1$qAQ8P%l4r+bfRK9bS!bnL7{z%FNAONF9@T2H z!BN+t0o^`fe%$FJ(Mr7neF0e+b=o)=*ZwBEXkR|6DpR({<1U34IuWJSe|!*Uuu{qR zG>kW#iEk?;?wcpy!lsNWR);e@da962%WpoB4>d^GwSosgAzua)__capR#t}dAF=YK z9>nU#AI_1y8H0ECY4X+6`SLlJ5vlPX0d=_ZkpO7KVh)xf8J89 z$I8it$WhUtN+HWW{YOP9*?h$u&-W8BK}{Xwz~E7AF%!t zkBnx@ijVO>ivN8D&HC@*|645E77}jG#1=SEW2s1EBPbQZzP6zrT45woeW@b!yvR&M z_Mcq;RYq&AzdR?;5G%+i%?822n}66z4AYBPcvwpH%jii_d51%;4tgQzuZqmXGnn<$&t! zu}i2R@7;k_zci?2yoe7d+#;W(oqWV$d33OA#B+G!@2S#>;&Q<+#w%P_USC>Tzj{<0 zW0q`|oNU(oA0J0`(26o{eXhUybQGi*+4SA%u*T>wo1eAe5GfXckVjd9L%L{izLZZ^=R4bk`4ZeZpzI;_VB`ckq+!`Zzezuz%+D zw*^T%oi>VaaCuJSY`q@hD15>}zJlO$2(5^T5{<-)@^;_iJUkWsv2Zs&l6~!de<-W* zyp~cSx50LNVg-ZGh|oaGyEh_?0xp<>p!BQvy`my^&)& zoyh?A)5Bc#N^BU+!1J(bWFQu!=t5e-Z6sx9Lv_W_tKAtuYlaoRG27W8ZxsvZX{FH? zzhX87uTNBcA}AdAX5VHNFqx6rO!Hurd{&_!cx6+jm;tV|pyl@<_j^jkfS|cgQNT|* zoLE;MdkqTJQijv%ToUF4$3TD`nnpbJI>)Ow(D;yCnv2#^X1ae);G^|@U<=>AyTjNl zkb>+V!MG(%UD7+KubJ2IyIftv)x24pdy35aTASnO$HatrGOo||NE(y7vfUU-g81jw zdn?FtDWw_aRP7x67CouMHA_TrdNjm7l_{`{rYW zv_f=pT&JHSnOK7NUH>-hD6suKECn~Nvb3|je3j3$9poR4K6bS`EUlnGy?FMVB|0!V zQqxy&v1rjXDO zOe9V2tC20;GwB6vp0{d4X}Z@9>z9)P6?~P9P}5fw2;x8_WXeyypa1UjCMXxUJwaQB z$v7VQ1$O%McVpT6kc+WLUW~|Eytvr?5=M4`70%0$kVRJ&olC10)QcF%1>XiZNnd_s zXu3~07Aj>MXyw~?a}3ylI|d*Md64n(4O|~BtE##v3CVC$vBHnDouDZL$oJH_4`j}>RTu2+d z+PmXc)k{y&h5mO3mMG`AO&K4-95gmpuspl!g;QCaEy%y)^7*2DITT;zJT{aFhlW^t zS1zF%db$Mmns$F@M$p38Y;orRX}dpbg;b?Y(Cbqfc0A^J&?IFxZd@6!I0JtI0=A89 zNohEWV1E|k)`(h%s>9s{b5q;{KU|yyI@5By@jLijSEmZ?pUGg@PsHgqE6%M7-2)IY z8v17t1xj_ei0Ai(MLevE*wZ^~AaWdlvo*E~e2ZNJ_z0Ayy)`z&pbhq)_okcQ?uGD^LiDolhO)A zT&TPw;|Tf&L2|S%wICyxNg1bf*?|YMw-`V?r?$uOF8Y`ll9X?}?88%YM?$j%-trti zdsg5b7g=L0{1=l`_H^iN2nZm*9(bt{%fR_@Mt))eT;`sRn( z9khbQsC=D0Xv3>Q#yU-C?CFW756keO*G(lFUD(a3&Eu}mX>OZ0;e?>ZVzX*Q7<_4}hS)=v1lPr^n&L6wby0gfr4uqJv!V@;>k)bT74Mg~ zP%%vL=tktuW8$9|x%T<~Q#$r@>w7j)df4LjNKN}y)cYymfEZL_`EF%Fcd59YFTAOc z2Xv>-!9D|r^!|v}|ES{%7zyY+hY>DLSAn%X zp$sL24NuUWoj5|GXt4$3#!Ye323SV?U`WGZL)w6hA1BeRj!stQ8ERR|a5S1gw ziYE;r{vAfrGcm1oxzrDeBn9F&9x*vch%u#j@u$X5S=OI z&q;Tn<9f$5bdLKv`>R2S-gY^9-1{PhsokB=-|&ifL1iE5a@VYND_h;`TV z^R8+)&u%eR>}h@^Du+eMXW)o$+4_kmeTb<*KCKN+VgW~^pBnwtLZeyXY4PNR=ckTi z2F=Yjos&xFl?z{L=TZA_+rPV(xT$Z~+DDI+Y9A=nn$0n7^di3O`dg~3r?uEY^Qd>I zHJT1YLgOif_Uz>)o}J->o~krW<{&zw!fPB3s7dc3a?j#7+Cj`<;}o zvETHO<$Lv!t@pxiF^e+meT*Myf0UK~?E93ou1cKEy_KKKEYCiIEBv6}u@B}BJrAC? zM-=ujux6tW;x`*@M9E2YQEB%2-_Hy*_bMb8|ViVhkU@ z=+_XWBp#wnRqy0!Goei-MTd|snVn(9`o5Eu#wVcndT-`Xw4{?LIkGZ8nQ@-d=7(SX z(dxdBP$ex3{4z5<;G#>EP8KDDK2@z}zF-NNe7Q0%Z(M9Fsa2_I5h?1O z!UF!bh+N@Z2cI*Dm20ddwdsDUG-4W6l5g|L>SPcH4m2pzj z$V=J2{i&nH4v{!Z_|wA*$|eCKK*syr+5^Zwl`O0`9FQ#fMi6dz zpY+L1NZdI7ydx8JaA3}Q%nCljjegdMm<wcME+j8n_cQD)1 zjQ##?b5#}(yH@ZQiSs!J*13v_HKMwG2NWu>?$oBq07@i_q&%wWo28Q3SlYYsijV1~ z+EGED9QXr7j3g2BnDYc<2Kc5IN#;=^x?=NX))d5gH=<>X0@Q2L7>5!|%U6%Gn!gji zdi5vO>Utn2>2#ivib{w6XgP&6@HAaklA~r$(SrE&jaoO8Q96nU$zpTu zca%-hFIqK%)XCeJzuLl$kUC=fWj{rk$o*~7h*aXVLltYRWa40GS>t`W3_hp94%H*) z(Qg}NriEs%a>Z>_ZqTuMV~(1BStMkT)<3tJ3W>j^l|MVZ_q%~4E}1*5bc_22qdD2k zn%EL{r|qH_C*YP50 z4DRU*2~lS?mRuLc1N+1<@ z&H?WgtemBL>Euyy9zM3Cd-O^0wRn@KKWk(Q@oTDv^N~>@V)>G>5B$m_9OM&2kcs&q zMy47?K!nAs)(ICa;GWk2*j~q1;nWPQJI{|YDF4nC*BB|B(=+R>HK@=ZC7ks{HGOW+ zG}GU_A%XRf#>PY?aMA!ue$MKHj;aXRnn%J0D%No=sF_Js>NY0sVlCPJ&81IA$`Xg_ zi}i|_XdWHt>$0~Ep)tUwp*l&GS&u4FO?hV}o&O_*I{5<;e+Ybqbj9={F`F&Q(hm)B z$-N%ycBdiUxm-ii9%0pBbZ^H%IIgQJd6*{B_4C38?(6O{)Xj%br#abVd4xe>iyqFA z#8lSAPp9!36>t+p^Oz>-eB!*fBy}6jc=l#BtVu3iZ_%~BXOG+QTxKxU5pqFRljx(8 zHWsqTFO<;GZ_qbO%;avJ24%41H_UWtRH>q<#({V(Ge9}wY+`#Xx2X~yk4|20EP;xI zX)lrD=t+y$WX-6yaUt1>ET%}*1ry9!_P%TH_4An1>ugxfa61zL#S?LzqG1m5Rp%e- zw>FZ@QV4^Q`9*(0(53QI@v{>ttpt59zn%;;f%(4n{N<630xHLsWVWKwz{vC3-BM1y zT@c3|?Lk%OGJ|2#3i7;P4Z6vnzNF}MXN(fQM)}WKXSR=K290J~Y(>qL9yr=jtKp~r zk{JC9b&vj*r(XB#TPT{%^h-VgV4V>`5gI`nIr59JGCt}3js!vUcU_O!eI$X5g3f(h zHqo;07VI5wDi%z7-V8W_3ySLKOdVY(gyAz;0mJ>mapqg{PQQHKu>w@(Lch!wP}SgK zU;=4!y^n6Ew_N$@K2vJSnL~QlJ=qOA7t^Ym91Gs8FO;V^443+T%kc&3GQWjc^IlTa zz%V@dUPVz|a&WgKcibP~yGs~lHx|X`Rt~Za7JP2=R&^lcB8=~i2ByW>LnB(oyp4X9 zRY`rz)=M<0(#W#<5i=I!g+X3(gAXb*ma-L@oYmKb4J(ZsWR8FLG3?>bmVk0u$U3^6 z?!N;_a@V_l_|${NUwkY$>A8|9m|jrbp_-Rtp!M_AOKFK!s=aJfi-GIQMCpVM51yoj z^+c@Jv&K?ZWaJ1Gn@M-6fGDo=%-3E({?muy$t3MLHIKnB?732YKclz>_-+Quas36B zuB3W`KWZi7vL}{G@6FhTID}7myhPQKI)pKOQrfuD-%T934+K3XUwIMV7En4mC4KrS zGE?kX07HnPYo`|gHEoOBPGbo;v*R4H96qpNCcb_tewa!Gbyf!pik~sXbaCg z+< z%)TGqBzqy(JKX*yNyfMlV|U5p*$#Wc4Mwzwm?lYpu2VV zM-EShOV3UhC-4*Z`J=s!fP~+^9!E0BSzXbVwbtMoj=;T>^SyZk4uwd@H^zi0N!?gY zlrYX`f*r2pwwA9QEkO=HZ%qzevd6++;>%X&wDy~j>?0Gp6%-p6>eP*p6#?bGH~ zQLDw&ToosOjhb1b>AC{-3Z7pC?{AGFiD-%6m=@?_<|7;@{ zJ^WC>0*oi5$&d+8R+BVPzufx+>NA8kWn|mxHjnRI?$&7qC6z4acYhp-U5T^6NcoMM z_AwUp+J&#F-x+H3eLy%8&3~f))IqKq_oNJ$?!^f08VD{(S$@#uQgI z^h*l0aD#a#WH;MvoXPge&#Tt2R4Ej@F!Zf8+_>`O3r%u z^_)m+nL@XR^xx_o?_a&*d<$X`Yz56E`@!H*p`+q(x>o4*ieL8WU?mvLz`&3_WU;1x zeFCkwnOZ_cgdSe`UyRLpzhX#dSeJ9bjjjY<)rei*QRInDQbTl-g>lL$WC?*8j5c;o zFdKDct|i>x#2-NZ97^bAlNOo>afCajQ#RhGUjq|Mb!+XaM*`M5S_9k>-qe5X1;(3u zx;Hd7*uBt0qoumdtnou2=+j|DF|Nd4ZBcT_+V>R;;twb&Zmoviyx|O^r%a-vP*8o; z7`gx*4ttxWt?yk#G+#MwFnGEE+JuGV)Tw!%Ea@C(x{3&e-5LWN+FeE+rilMr^R z)5Gr4>KV$MEP5Uw6)}(a?9It+8Ahon{9azBIg2^y$_;wuRAUsGmG?aH>^rg`q&u?G zadl>PF#ry1D|d7!X4rYrNjE<0*;!w`Yw2*7UX|U2s+^>Fp`LCkRNbi7+nmjYn>Kyt}e8$ywnWC5X((> zQQbTpd#YJg{~GxFq+ml~I8OVBOl3t}rmwDNAM)t>J0U5gv}?0pWrW^m%*f}Urs82d z-r0OP5k9@dH8oGW3JU@7c)ZyfNKDy!%a3l(AS11l!h$ zu`t_T(b1xz3_d{AyY|ehj8oD3_|Cr}wlW>eI^;~OY`+4Zgn6QD z;k?0u{33r}jrAUMeX4>{RN6~7#>UZw@khd{>4)CT70e%;;u+B8%4^75z179GdGk^! z9I1bL;{mA=_Okc9QfW@xKa#Pnd<+&C`QsO_e2GpNPBsTo0DWfE6#cm<28?D5#wxB~ z((^k~>9pHi{e7DXHt+U$VyMVrXE4IPgnrP#9r?V}u;1Jh-R+~<*yFIf$OH^z^D6UNvyM+ zF<>Gsol;H=3*+)gO+Tkqv8n!(~&JI|2*Mz`s5Iu5LuBBK@Tsmv8F0vt}XPDa{iGCIsy*W@YAwI6%o zQBd%?vXYI*y91EosHoP z7n^QBXoSDGp$%TQ5R5MVglJ}vesde)QpC5#r=d5I+;Au$izR}WN~pP`5(3p#5_jJz(zxNub!Eki6iXr1K;#W%B{3&EF7tvWRQ+%6_ztU~zzsoc9L_xoy z?;^nabZENtTLdLp$uN7?L%se-xKTD#8W`w$(n8`h9rZBTctvm=7iTo?zi<^a!t{x* z)$d6W?=u=2e=EFiYf$aB+qz$=h_Vf4s}k${To*YP-`-#970a&Fgrv1RvQ z6p-}rSg&9W>41wmnVm|Bu*9b230T!l8vN42O5$9)e(Z4ADK_pj$U6&wt{j}-yxBeT z^&gaz(u=OAxNFnk;2V`Y_imQ}mHaY)w?4*KBNpMf@}2Q>XhP+3`O?+a$=kZ*)u0s0 zKgLfl%_!Y`b}6w-dCToFc{hhnbtp1A#$^$4H)<+s@3cElM$zny{e{Bgay&R31B$d< zAxI-rs&EE~b{q5NGbokv)<|%SEh4=9+**vRS(wDgw=VAf&m!C)METj{rb4BzkRPxA z8Yxrf{?fxvxa??Fn&9XBC@NEyY&ux~x1ya~e4bIb35-bUQ|wxIZYcSvLbAiC{<%PS zbDiZO1#yDKm~pZh;8s$6@$>04dchwX)!YJCwcV9xoxhGiY=)Syrxu$Fie<%lF?? z;*sbJdI+)FJA_;A7Y~sA;sIhX-~Uj*)?fGGCQpdi?T;rDkuAu{uCJ|~*mec_kbSA> z^q7L_*$7m!V*)$Eo*NTx{?-IZbn_nuw;i~nXJd({pNKb^1;7IRS1)?)Rl${abM^0g z>9a`4N9<1_pOl0AkL!w=Sfa)`pos?*>lW3kC8n#t&aV-u{l`XN5V3m;s~F|258Pbk zyw(PhUe_{_^e+U@FRe4Fw7Q4lNzk#A-=^32WQoG|2zIGB^SI?~TkQsgQ|veC%QXUl z8oG1NofPp^_hU$u&AMVb{LrH>35-t3UsOz_YaS^Y8(#o)lU9ifAxj=eutpW?eu3nQ`7$1waU-f z5lpVLJn+SbC{%pWw82`SuxBJbj@#1}Hoq#;TfB&0!DS=(%%_V=?KV=o6xX(>74J4{ zA_3Z}@@bbN7#j$;auq-8Rq}2g(YS6~e;u3!7v1pZ9zhBbGBeWM3ohOTeJ!ojNlM(5 zB8YBSZhy;HI@nz)@zyYTM13X)mz@cvF1FS1O1Whio|xBaxlX2tqxhuqPN02pWRS#8l*Hozy;jpcX+enSo=6mz%%K|S;7g6>|sj`p0D!>7sh$yOT z`1X-9{U}%1<7cP%?O%Gso27(f@yyy=4wAx!lqyoRd~fheX|@@)FAtJmt};d$jk!42 zudHy!S}*ARm|+h?-okyqH7O7G4k|3g*7jk|>%l0s=4q@>Vd}F6F&%)ja%`XXAY9)w zpzXeib0t3r#2gH+)SuMdq^SXgraBWjRP=c~7F{F1GGMrGx`+<6inhB)7*kJGCbc8wgW} zyx&Dy(XAi*>jdy!I&2;9_|`*_Cs^rFTxbB2y0F5l5%Xcihi#sCsag65n((s=M4teP zymUj9F2C=;vr^Y)O&F0bMtNrypVvNnduaJ)D@};7u6u7h9Z3Trs_r5!i*sjmb|qKSZ866xp3N0UdD%b`Y=A2e2bW5mOj` z;YM(s7Zk5al)3!`ChACQzI2J$XQi%<+BUWbkuzr<5VGQaNN3f>CLr*7R`hHYwRV=3 z1{rHQqvQqo4v)}|^`}JKvpioI^{La~91u9z`aH}I5af{UORF%Wg9B%^Y7`lB55CJ| zF>dTylKMH+jQ@)DTaU%c9Vc+9hd15dp_z-cjUojr<%BLp=rVLp?77?GVL^S6R_uva zeq9@rn2odW&>0NM;MaFWz0tPQ^Vl&JPDjSgvFbXU&Dphz0Z-$=$GpC8Xdw!_RfY_-(|mdpU=vYWmQ``_yCc+zn& z79bDG&ihA%6Tl!NubPc+A9-T!L>FN28npEOIe3z=<>C9np0s_7c(>amPbjZvV$@Wt zk;_3eU*@s@S5fAoO%1CRMFa13%1*r{8BV|VK_KfQsKbM@QFvUcTZW&%W zsox%XYtp=gt-yL$np&#duH%dEMBCHHkI)m*%gWVGgACp)Yi7q$sa3!=P~;4}d3bK` zGpf?rZlz=q9=UcDo*Z^L+bP!QUit(1f@0G=5%g3e zYN(t=s|*}^SNfA)->O6;kO>1r>*)AC97kDTB9oBCj_`Bl-){gZMxf7XyTfxf_tk2;Zda%2Sf{bPiLtXsVX>UJ4ogtSMo0vI zdojjx_9qwETdv#Sa2NA&On6qX@hYC%I^O;JG`43n;m3Z6KznI#_jYh>37z;Do97V0C=?~jYkhf8eLtU#}ZClaj<$mIj#mU^_y;W>Zy0(;ifOEw>eFT!fW*y zYnuyyP#UgZ=E!M_-=1`I8u>N7R5gCuuv+bWRP75@R33;GDmqJVcZPNoen7K)I^SPU z&+|WAOhVy_s*wGx_A4q<9ERA{n7;`d+0wRCHmr>sJGe9majMgQ$YNQ#3E0QH(Uq&= z<~T zO^k>O0Rh3cS6RD-cKyaxQEqGPnMgr#UN7B&2&ysgRNbuT-HOmKf$!k7AfLo0y^Ab_ zT_-bYt$W1v=OuK&9m$66SOiQ#x4zbK&f&o`E3xSd1Nkv+Nw3UK2_ZiLSig6 z%hM0lW#Xgtv*(n(%dLT^l`lhU3|`CUs_@7cej&Y7jy}dB9GC?_DS9uj6gA*VeAgB& z&B{hz^l+0QZJIJaw1+fw(*Ch8upQQ*1;x(Hh#2GvYC(9@-9~@>@le}2h3C~D*6bIj zxa}Nx-!FFt=im>c7KLjfhWL!Ifj!ZLrfBXw^%4bX!c(!bnLaaePhcn{$bs*+y%-)` z$lVL{(6FW!VjwH?q;U9#8pA3IHcMLOjnmKO3A>+Vt?q*{VH4EdItsX5ZJY5_%ht=c<~Tt?MF4Se}+C-mK`42Sy3s;I~P+FgOp7T0GruJ_}c z97nNU)(q%U{vYDru`#kPY!__Bwv&!+yJOpS(lIJ#$F|+E zZFlUXlXOtAE4Ecr&wJ+lf;ltuv3Bhb8*8t1-)Y=m(R%%z)8EzW)W_ z>LAWINuF=dfPE+Ax233u>j!Z6Nmg*d6&;CEp-2v!ALGf~f`w|LeIOR!^L7IEJ9U}8GHChy$r!%LP2`6% z@b)mxu#JUN3XK*Gen|9g(CqIC4Cl+k%OSau#y=vVNXr2aqbjXY!;s&=@|DKj{l#TV zkj1EEw3o_m<~wUd)dF6P*ALrD`=hmvuAS{UcgUBt)p5!3zk*RdsRaiL{l`Ro`afm# z`2U6J;jooPw3craoj73mX}<5K9nO*ULDkZKD4{O$(gH+>c5z+K7qI>l;ngv|JQE8i zRogp~JbGXI=Y~N%=2zIvT z&x^YERoknZ9U1t)8 zK~3N@bAc0?nxmI6DM-L&hMaBhB)za&!}X-)?tlKQB3=P?pc>ZaG$Gj1Q`*EYf-y_4 zIz}@TrkHD^zDq#ezz)JLZklrnINwChmR3=wD}`FavYi}Pi%nkqAG?v|pq<4G4H_>X zTJ}IRU?qf?(2!0q;d^}Y-_i~dcxEae>sI}d5ps5clba;k7+4d1YZZ5V4~{&FhFx}q ziDb&eC#vp@ujF$-8B}6SbsStU?OiFIGY=|MBZb)r+}lxO2?)rsLDq=wwBg0~mJe6fK z|5k-#w-SbvHDK&)G5;?JmkCQDPO{p(*(vFpdwqE}neq_a5k}drbCXxXir*Rw7vC_K zDgid^)PJ1n<;t1)3=Nr=4Lm_Sw|-XK2*$f5wNR}1p0kdjovxG*x?B={{GVWwWo0P~ zGvPeq!p4$eh#XB;T(ePqPYIzRc*}p@xfI zmHY~df`KuyqOjg*EhBM zQaAj2&RE>azWbMSqzcfKHqiy}lSAyI5IwS4I;rnU_MAm1kTC`X9iJ?NsL3pbI2`L~| zvHOT`Va^l2#8P&JjrIcvly9K6{BMc9R@?J!koerhe20=7ik3Z+G6B7Uwys6VR+)b) zDgxFeM15l3{o96Ec){p)QlxbvI;m8VNyIxXcXsdS88dxo_V;TTTj-jJU)O|56wq>E zpw2MFnTAx1MBnqE{Xe}Z4{bUB5eF<*98| ziJ$3<=<|ApxKTOj`!koZVBv8Qp|O;_75KKEalXYcTsl7oJ3s@BNZ>>aN7@AcYIj!dKj!>BK64*1i* z1KN)CBU8pYcsX>N77osr*OE-N5d+o5*<+ZYxz2v5V3C8uW!~}y*2NNBym_Cmb>_iIVSVkPy z!|KYLTeY6xCsT+fR$u%I;R_9U?pOpF1A|VxgNVqIw8}MVf~#T0OLjBz5NZVO{}}WN ze!4TkIvsbWZa|cz(NuDI^l~F%_PBUTMFj~CUwh*>|{C?ZLvVf8`BE*S=ao!?nk7@!T2D}EKVWKyYzcC^Wm_exG| z%c7eu-cQ`Va2=zet|gU=CWvfEBY_U?blxp zxkuhxzGiBrtVOu-OjXi!Q8+6Vfw+Q;55rj7tVc_y+~e~15f<-!cHR2d9FxPPRl30= zzZu-(+e<*$u{Xc2zG>tS)E%WxFFWXN#2WnDr@SRrNSiwC@?q?S&uw^i8TOCsT-amL zO59My0X-O-GS(Qcx%GS3cFPfG*tc35mKO!Ht64F~oDxZE2oUo-KSElRCbT{*RR0`H zA8BDLzXW&M@A}@uCsP@Lo`{W8V3X;j06JpiwR@LRayycA&!M{C>WpdMf|U4EA*R4) zB%9-1T(18lK0jdL%^E!a=T(0Sfj-*!@7VtrA$0!_i!Z3@-g*}J)EQE>0U2}nNO3rX z;0V-DEQ~_=%csNL#8bgK8?`3+%drqKiVY6LiSoA^j$8$gfi)F74sxh*=Q?w+G!zx- zlapI^5Ap{F#s9_vwqwMtB4yBQm26t5!IQLXD56zg z0>Y75!=>j_Bu<-zjXn)%L;f!%ow91ud*wKxYHAQG6H=6iLnvZ@HizG^#QQM@P_fnP zbk&iRwDk7&wz26{rV)p5AV}Uly)`vZ%m4nhJ8ltkyjltY4sQ#b9HxL{G4du5Mko9X zQN$%l9a|zzGO@!B7XbY!1G{OlN@!0d_qy4mk|66|>fvMa)EUZfV7=7@0OnA;Wxzgl z4DhL`shKuyXnn;)gof173*S*;Ro{3B-CbO6nEkKS!UqE_7p7pWVy=GT=VEv=M9oYy z`khd>UCr-vKu%9D=ooyyRAO)o&tJAa`KqR`7;Wac9fW|5jSYUktP{Ndr?$Ab2)Sh@ zF%y#=1m?HrL@8n(Hyi9V47SvXAMD|xNLKZdd|836${6c^RLH_aXC&7!CTkc)Ua(9lV8H1J=xps=(+Vgdso1S3*n<0`5CxcwoU&nhyOp;BoM~R+8XaC_LR93HkbFu34&RFuI1-XO)!oo zGapORD-@aR1QU8nJ{6806IknIH%~#4dk7XA1=Ghlh2tJr3 z@{2JYg(_~Q`~X;@VB+-NOTh5W$W?+g^qFkMuv<4)Gie#8a}nXsux_{K&R3N6{H&~@ zgPXr7!9Y73+f#^esqNuX_?PG)7HUr7x^7faB%gjLSS6>1A|3vjg*r1VLx=Qr}bo$Xs1ll?%1U~3#RL;f#IT(nvU84?t60t zzgJdGH)^8KPN90OcH;z&Zy4`?woQJD^sfg6aTEJqB?|gH6riG>^y8^LYAS7X%}wRO zreP^%<>qeEcO()#m$9JZkV@x$MkUN+7t@06E;p=$39a-=*O_43@QPH-{6oY=rSRZ@ z0d}lo4Y#L2F?5&C52WAvit_gD{nt(x30c3+QR@b#4|(4^pCWi~L-0Mmhk(ap5KltyiHs94gK9Ze6BD`Pqu9@pd{$|pOB8PDYW4_YX&C0-=aV%b7i(APRQuJ%>$Ja>ahdiTv zG9&+8e+l~i1M^cM3(ILxKoh;RtFjb1Eh1fRR=ywvnUfc^AZpJjC36 z-4I)$|Crgs?6_KTm@4El`(h65qL)qo;14L&Dk0LLEAri`ETo|t=xpnGpAh+)_aKwO>yhY+U>tlZ+XARxrW@O2DG0xD0S+?qO@QO-(J`Xr|m5CzMY4a z^(lA#^@vTY-v^=8&Rz7c>SgsSnmc+ zD^M>=cW>uqr~m#M;8)czIwfxDw4(o+xz}lD^_h)IsGns%FK2kX>-w5swF5(oKZ&`_ z>D##1aiMyhDA~7yVU%2<0-fgKPBZ zgS0_a4*Zni^eQ7nyrz7vV3?oF<{P!__E^j8A>Ubht?=Shon8wD+({T0lny{~}79buQGEte2 zu*cXOBuaWkf8wiX?kEctn_hN*DKwSZ zP-bWa9HIQ$f{*FxsN0tfMV~T$-WM|P6g{PT#H?|m;sCWdq(ckS_eqa-N^Z~!;L%VDq;vz77yr zqr_*mlKM{yN;I`&Ph6r5gLQXF(EawUJh85C?c#@Ll^0iAs5Q!kZFU#y&6%o0@Xa>u zn}zpFC;xi~tJG*K`0e)lW=5Xsv;hYjMrh2xX{kgseEap))%be&#jN%YiGsBq@d zdi6JU9>MoF)YQ=AAh7$b9{0HNvX95cgD4SbG~j(dAl>QyHE-qWX?bQKF_~rnU~dIaiQV$n?AJwz~^-hF!aAQLm7K$G->gWn- ze2HPAr_(dSG%0_18lILli=Wt56nrf7DL?6n=i<(a7)3OkUr%bOI-JPJDA*aA@w=ZE zgeGGhO|SFW9w9p$nhX&9eK=$>QBA}MO_4Us9Luhr`%~F0s5{i7nmSEY!}l%zyl03k z#mU)aq{X&2lVJEq0o_m#d%n`b)6#LNYRz^3m2B4uE zebM|<;rZYzM1Ab3LVS*0aJ;MncFyaCTBeyUO;|Gv(7EthS>h3X1~`mp6``3xIyo6} zmruVJuR079Z;b>kph5L8J2*Rm&9R)b>X8!EqQi4D|HLkZA3o}^=CYf-l@B|W^*C0i zNx`mibn~o<-Fd<>)T_9G>LtGka$sc`bKM2Nw{QC2W6~1|TwkWQ;q*32GId`()-e~r zsA|@M-|1VhLK2H=-&ek|j(VZ@KgoL=}D`%`ePBsnxy7VIEyjwolGIU{{d9gtyO zSEkthy)#o;^cv@T+nW8jqC3%R4`aiyJHRPCgQ12RiOte|8kJD7SaAfD_gUjnXR6*W||jS6mo?d}qW zn7bl^k6w=5k(YSf!u#8fLvn14*Wj5$<8rt-mqELUoUtPQ@fSvkzX_Ia9I7iFaJ>~~ zW!D{T(KSE7G;M%2c!Iv;@9gBCERjP`gh>IfO}b$(+yVDx`Cvk@&wbHhlbP5+@+8Q@ z1yN&*Sp{ky-qJTrTcMH?~PQb@I0P7=ShEkNy??4#*?1dw%?|W-1VC=Hg(^Jr0-TgKi zA5cLpTA1yhGm~j!pBO4^C?;+>)7iJ7%U0*qZ$Q$#O-j~wRhqqU^pb`l`vzxVm_d_L zasc~|FgCwnk$B7t_r!LXmV7R_)q8csZiHq~;~DdW)2#=%kB#@6M>iLH@#{0tXxt4O zeWwIbSx)l6zBySF#NFYqFXV&m+73A-;CA}S*sUfHm-Cp?j&&sVYDAwsDJ zwu>tE`RFBoS8r)|Z z<<<0y7Y-?Gr`7%2M-Rz%fVA<;`J(s>L^7RDLe_TFbgqIbE@z|yG@{6bx9Y)u)85vP6=II3Jc=Q_H+7jJ$Cj@ zPUdMzQZMEe)WlI=(lX~Fqx8<3`@R63tL4+H>Y$F3tvb6=HDy)n&KTImBi=^`A@|D; zuTVHu(i)3-jk%D>$RV^bpxdrEw{x*I(5S4F(I5`gh8|kpQrnAwRk8O{&5t*Me_|qj8T5ksSyv%z*abKQ8fO9;9;9of}mL~i&CbFN2sHYnH+Rh+EfSZ zQnCYX{ZgS-K(mpA7V$-(Yxeq-{xVI?%lEy~eLeRaT%Z zdz$m4IG%&{!cq-BPCm7BOg$xOWZGYHS9bi5C8f_w_t;-(5+Tq? z@IFVk9%XWymLe(YaF%Z?c>b2Bi7>0jiE@c~B-G`iv$N_}o}HyjQCdEuS5>mNKVvVu z+a((-%{)B`yLg5deE2@?jgfzzZ7KH8*rb@9Nc}BiH)|w)twgI8k*{uWkX0_-Wxd{~ ztnsD_!v+Kdr7bZvA;8U1Hk4QDYCM)qnup3^1KMXU{9YCHwbF8%JVSZ^Rsdbl$UkzK z5JF6UMYx;eoyrZ)Wp~YtSdoVtie2{Fud!-4MtkGNZzZRtSnO!%bneCdbh%FP5&O?PxmSi^1Amr*FDdC04|2%5X5|;MBzA1 zFGjNGmSK7;RF?=zC8b%1oV{+FWUtvb8sPkEeaDm9vub*Z7HHrOxHp3zE(BKe0pfB3 zpwZM??M}LA!B#5_72x zNpEMijvbdVJ!N^R>QrOqG{lupHQ;#`gpBe+JzoqwZf1JBF6K6HIqvGbqtTO88UmO# zzi4{Dyb*%0W$Mo6yRP$Ee3`tC17bE+y3RJ9AEZyluwalx8xlKvA%DsvJ^FP z3;bGlys)_&wR)VsR~l}PrH-%+Bv;U>x3Tt;9LmVaYAP!&9R)`uVe)b_N6GYLOb_E2 zW-ovEPmc$Dbm%aYuuJMdgkL}Hqjn(UVdy;Ejp(nfVxzpk!^*zA86#7zO9Pq4Vos5 zjnVRh@LiA4V@`p0ab4yv6F=$B^o2_u2PmP;m<4g!P0rMg(!OnRTmD;b;hr_{`9O$* z`6$NqlaI^_IE}s??UuH%VlW5>=eA)|nw)Y!TiqcDOo!3H zcdXi-kqDEN;B^;Y)7LIBgP)%j95*P^x9*l^o@INYnNlESEnu;UfaGXNsdwG@0OnGQ z$-6Q}@9y6kzhmQH3pUc+cGl58;Rw# ziScSVWO@-)@qf@!f9UC(B=#$P+S}5CGLmI!73{dOnKhYM`gmC`LXsR>=O@nd86DC= zC-yNt4v|^+>U(+ZP8`Lnnn|rZI>d>Vw4&{Mju&agDHJ^l`sA~}p*ddXN8wHZ^SZtB zu(k15iL_{jJtnr~<)rpXI*wn>vaMr`8ygwAQJ*4zcCX2-x_dY}tw@gTxQBLtsb0ID zSMpND-CuxfSnbn~i04_Mhy1pi>WBJcZgE$t%F{xieL7FO=hYQ`ywHb;MKrOqg^O2V zOl{rT<9Oeua6uMdkV}jITlnb5gGJ9~By*UQrJ}|LD8Ta#INS9W-SLmnEznl#+8A-R zd^Q&K}!TmjI_Gi@H0qttMSD;s|@%{saoWsgXTiNpw`cpUJ9=5}!*ckWxR8PCw z%b#6#@NIrbnP$~Ov3opsj3gd!gZ*KBg){hI9{c;JA1oaB2eKWn@Oi=R9ZXE^&%?JP ze)%;B0$c>EGx-IjhpyJvw4I)wH@+LbYqltes*(X!)+b>{J62vu)Z0@2{foa#OX*xM zlE546+0$NL5;!emiR4l@H;2D7u}%9>Q6*hq9k_}$d7inS1|mYLbrEXcWb*SWI)2zr- zHK2VmMkkKPF(4JKFE4xj`Pf6Hf0unUv2gc8EakfkvB0!boS}a_w|LiC(3Y?yV8x{S zOS^3M^C7r^r2a4P{clg&zd?ES(lat%pNcriHzN|VO!Q4s6YsiN2g;&vvgi=)i2U^F zea8kdTc$W!sKeba9Q639?oCvMn-&!1;o|Uc1fCXW6468ewe~_5a}}{*P^$6XNY; zdAk14wPkPJP=LolaGDd+>SRekr#Bkl|312`l=+pw z9(Z#zOB~SU^65G$Dh(%E=joKuj9gUgKrX<$V*VFXxWfH;pOOFDPX3nPV}7ga>Z}5{ z+nM)qyl}@WNZ9Lbdc&;j>!;F4!pwxOYURW~Sq=Hq#c)ZJjeAdK z=KiAYI&AsaD>T%tEX>?eV?P|KblG`gcIp5lk|BsDy4Ls~Hx~8~=oshlkeQx|Db^zX zS?~v)Fkek|y{C?eLtY5cNgoF6k8-%0?Wun{!B&~|n^|Fjc+oR6QU{djsTQzSrwow6 zz}4fQ({VT#YcZ!Tz@x{(ZKKI0Q34BM>bRV9%S<#Q5W1~kBsq6a|F{{p^4GE3y1&fb zk_kfnRRy2Q82Ot_wLN4sXBc}P#C38XTnl{Z_Yh#4l!+Tsw=cU#u3O{#&ADo6p=MaO zu(APM65wE(D!w)YNlU*oa)#?d)6U(PBfsI&e!?LyR{S}YJIb%TbU$eaqeP^|7%zv5 zvyg#r2)-4vN&DT_Xz~lI?``IOxYQ5)aU@QHj#JaOHzUD@?Shi?V)oQXzT-d64 zK0M7mP_h>%>G7|hjWP7xhczv&)id2#EtiO$-F)Xt(tm6cu1yEx_dY*Lg%fb%a@X9= zylPHksoFE@<-N~lw*Ry<{$nSm63yk%E)>o0p!To4x;cOf`$a(ulnRRJsEomLB(>*0PSReOP>~osBF!xZ=D+Yy>zXD|nzKHG2j} zl!x|0^}h@Ole43{GpFfs&?T39!39~bzDcECRGr!ncO@8YH6XyZ{*e= zm^TtVoq&<36TB4m+{JmD1nij>q!Hp3$_c}SYJgpM%qbX^3Mq=PjY>{1Fj)L+RdBU` z^OONgHEwZnc`?*>MhTb)QG~6XQ9vgviVRwLE23oR?{OV8WyWxI^Wvv}F1{fHuKaG? z+8s#f9E9W^Ia^~FK_W6rsZ)a31?qo_920<;*jfm|tqqSaA;s4X@oS|ggk#;enYI;3 zYvA`6VS@SSC4qayIuB4^Tfjzwn_~kipo>@M6e7=y^`>tFgNkxxlr~t?Jp%1J?N<#S zlgjdF(NC%j1KzXubRHSdp>tJ~yPY)#<@noj(3$5Q*X$=dFJErS*?m9{Z3OZ`b7OXh zhD*69jJQu@BxvZ-c%B=M#LWKN=@wrK5qo@$z)HbaFFs)IXx^*yRz`3w>IWp^1-?zv zLibKsNs!JxfAwa*HuzYkDoGn>mB=ri814}MUC#<`KJ;SaD>gS|A;tJqih#nnRvVc?KE}%>j%TJS^ON}9)^xZ_u z^%fvj7#Rg7MReGO+d>7TQ5dSY^g`8P!1B~=RGcg`lY*(r?gaK!EC$6ij$*nO0 zxS3>xg%w@+pFPC0&t`cgRffJ&!6$hTz)qa>zzWWk-5qVR7C{dos6JS845bVoa2@|f-qKBH0hm0^v;$hC0p0_YDtB* zRKoH5#}n`K;1dx6;@i&fdquWz)>vd&Rou{^`nf_cKjLoI!hxF4pE7#?j_2Uv$2}@1 zb5UGh{i5yQdCA@w)o3l=cWzS76iw^XfGV=C(HbRH*l0k#Wk%VX9qu=7OPX z+8nRi8{AO&C{=b<@nNd0L#SztQz5<*dMliTo+=}8I7fpFSVN`Hg0p7-R2thKz3)|1 zR^zZgh!~9AA^t~2Cw9;By3-(|4`cRpm}P1Y+4acFFG7~;3l4fLb9{W76K`PsOhvY) zI$NirX-$NDo(*1`hV8w~Ggrw7es$4bTkdks;<1>2+SM%{POBhGOtw_X_^BsLK<59( z0`dsF+@s!O`fv@Wj^QwolzbCmpPCV>r@}80{Wzk?Lle;~J!a2RQ9kK!h*I(ZPWj{7 zv^gHyh^R8S zxb3!pe`KSUNPvq;ZdRHJPcd1|+r1qzT1I}CZku1@4fCA>6~_`4lyw;5%y+`9E~aq# z`)Z&JzF;d&0k|JeHikX-ZP-0d(CTm@TMm}e$Be}9&u6A|Ko!o(xYEj5bVrPY;N#)Y zKUgc~JGAli>@?s3m|7C=(Q|*1r$;BzcuI4iZ~XOa#3Z(?Uob1yw{N4B_C0KRaK~-< zmr`x+p|JMr_)BgAx%2Pk;EppZ#rz9mLVn@QV5Y!P&NC{w!DEWA#7T+Ac6=@C%qvlP3YyX@8g9+-KA!%pcUo3 zu|v})c7~+Mb%On$ZO7}(ISa4uG{;tM+_yR)3}4rM`Z@-!yirP=ZX8A%GOHW0wa9q% zJQSotXQc2BNjbQ%) zCgvt%&-lQ^v0S!Y*YAiKy_!`rsrPD@>rIZZRkoER{Oo*+O2;1-9itol6|zb(a(+n>sGZ-9Z{}yY@Qyr$JM!!;58Tfd%v(?f<{`)DP^JhM-^wfkSoc3 z5xD#9YKtL)K2DCg=XM6cVk3ggE#U5q-iKpoFbm{=OBt$d-;lunIK%(<;e1x;jaW9T z?_)r&`^Z#f2j`&y+_~8?0e6{wVG8=GtTSI+h_97QS4gUNEC4Is!^wTf8jjhLo>Hh zBm*ro{k|IN4{>|UwDffG8Fl-=W`M~$xkJ&yZ!s8bTUO)b11Tk;;Z zO1<|dZGMG?QY1|2s&gLGf}Ss@??%h_$JNB}!34QkU9J}X`1!jRHBZZZl`&DN!fOfR zWiQe1b%HCEddp?3SD_3OdwQ+8>L+%%p;%QJeeU+PDUnLVwLX{U(+c}@b}aL$d=v<$2P0y46zYJHr!gD0$Pm*qz{w^oa_J$&FU`D>SdoFnCA|H%yi z=T;rW7&pyGlF|}-9r`Bza)yg0llQSZ)mw~wTsQK)SQta4i30HE0AJC0|1H9J5dTy; zVQH1lO3UwqB!H9nIXZ5ke4(U!&0@2;t+he&FCC4T(#~OSYSSdb-)E+sO-zX7g%BZ& zrf26rD;HOKJadNQjJRHs@{6h}cYj+>;ppnNw|>t$H2PP0S!Hi`!r?QQ8b739m^f?8 zqq+eS-(q|d)NLmVbaMzQIF2SK8Zl1gqYu4X_3r8#ZbxgwWxesfbm;DXeIqq#T9H=!RqvtuUdSE10rg?V zo7rDle%g}OERIZ^eY~2A8}001-TCt)D_m=obq?i|u*v)T>Fx88Pk-bjg9v*#K5rQX z`ZT`WY5$|g-7u5Edo&^I{C(>^-#Kp3*{}yCYG#LS6`jwNAs0yp(qecVhpxO*P&C%YCr^1H;32QL8I%1u&b^VR*A(S<^lO@fh5M4^g%NX4X7_imx0UvrDZVF zxOF-UW|E&`a8wxu4d`&R6(8}i1cca{TTB|PcZJT!Y~9`VW*D*DzH-UBzC^W5%I-?C zYv>`j;nB_kGszHRDbUYWPjb8ZDhcXUzeSbMFQ?07isK*ljnbNy&KVC4Mc0*(yp5nT z4!CxjAfWHpbvjslFW`hXIuG0&!+NY{N`5&Fr_Ci#o4M}WrQFE$w`@$0N9=q{UR!XOLQ}Zlx%7Cj9F5_1_AQ{}xLY zaa+UbDWegw79U>2F)twsKJdiJ@!-SWXAOoh<>+mgV97kH!gE~d;;FK;Vm5}<N38#K z_@iamNMdALL)<(mh^fWCG74#C{$oxLhGB7*ej76m_7z@L-ZVs(qYnoWZ0s5gof#?LjjO&K*Lfm+LYhj>uo`&1y>bxh(954~y zYvtNM@2Bm}Jp(_6dAJ8IG&zNvo$i6ejKUZ%sD|1lGb};N$CVutL%Wq~ z+bV87nGy>))7H{azVlS?^Uftr4Huc>Um|=sIV$Zk*6^VWsz2NaIEXZ2H>|D*;RV^q z*~LiF>c_{-PSycW&2gbtzd|}iRP`D1Ef>|7+jJ>`xBH@{dRw|`YBhrZPgfIP-CBLB zy@WGp4SPScY%ft1E=aO8!=wyqqFtpBW2Ucz768DuFhtlm_*d7+AhztQ%+yNr)Vg-V zFA+%xzxy4t*j4~NT)HK*qM7SIS}y<=8Mdx(4WbvK29{J7(OL0Sw=Z7&F{c~nBFQ;x z=QVQI+q`e(qO3^+p1QfJ<`T_427KtH|5eG9COm=BgqbR_U_gbjqmHNVT-3MtnQ8R; za`W)s*4EyIer7s+BWVJ9F7hrKkugaw4O<0^(cflvq!lxzS&AZt$g_5oO_}n1Z1SiRjjH2l@WrK z*Mqdr;XxU0Pj@p!KC$DrB!-M`u6`|hRk?3^OJ%z-RVKNtZx63pWzS|2?|d~aPie20 zsK#X;j;lT{iu%tP&8cF`|E$nJ#ZgpMIZj^ArDi_&4S_?cg^4l_r$4gO(6xyD+&R_V z?c!k9){0wZNpI{i{R@Ls4Yv3h(oyn=zn5W0uf25sb!}I;U+b+FgL-@;%PkaW_v#8{ zBYE}#x;qNR96GiGkhk>P0N}K`j>l@)x-~uf+@`nmM~WL-s+Ksm&ab$Zc3aPL{<*#f z=k$9S4*mEC9saC7j>CsUeuX7%b}9U)tpU$-*e~yGAeV@LB}=T}wD8HHxTTG3_lxu> zt-}~N&9k2HU}jE@VMX{Rf`8iA?6^VjWLX!_ zH*W7|Mvm41!y;Q$A5Qfspwze#B^`!RJv}9Ln(5@2-vIn(&0^G>avZdrol9b+F)QyH z=*J8*8e&SIPZjcFMtPzRFv`msLUc%$GAM{F6K({^+dqZ@fW)TmbeY5Hh+LZL9E}HF zx3aSGU(Zvq?)O*DyrM#C2dBN6Bg5otTFz6E!x$L(h51Fed&}a7QqwJ>&K1I2kyX*J zJtG`W@0B$6K|{c`$IIo;m7BsCfzWepdYwFaF(T@RHvDsQs&p?0N^=LhnO$>L+xu}# zcF9T`^qf=HV!5W6OzVEv_@v@%Jk#bvdUV;{zk_k|)jsT}oZ$^#H+#QKrGW&xI8TAp}K&Fu*xHXE}4tXwjrz|q))mx;_u7LIqU z7E&z|8K^!x^O`Zk^4t7DN`OpsGGs;|YYvx5`J1j!sF*`lf|4>*qSP$)B=QzB4$~+n zm8!Lk_(R*wJ#j@K>}voc-QJsmys#yFBSP(OcGHp47Y7}c(gAJ9sM!Q5yy(RBM3lE7wG5b7xs1C5a)|CWT= zTo@?3DHdOfS>ds?177E?CN{l1gwEfRQObLCPNHdbc7ChVmF&lb@p3akFYYFuq>8H1}5u#WJDU=ulds35`qcE;B z*KoLYziWZ`dfrkpguT4i1G}XPqp6*5Z*$YJOIWPM)f8!-QiXCZ6505vBl?9j>LQ9V zH&3j-LvihlmeB-tB+y1t%t80iYa!}<@66JkcFrPnDiT3FXeFHEZ&BaARAc=1FUskOZfzJ zvDhQpm`!#jrg*vq5ODUJ&%bX9Js+`&^pOKpdCX*aRt+ZU4Ko&+OO!z0gPOiOVsNg6 z-^xmrHt=wSS9<^97;Zr#Zd;HjT=+uES@}I+r}8aP3sK`Wo+Cb<@@Gyl)-vTYPLu26 zKiiz6^|k@)Gj;q(71ckyQ*qtE-ja)w%Dq+F=qFh>ifTp|H4U5AxVnZI4Wp zUR+tVcP9hbwrFcp?Xhz_MRikYv&(OixScGqotCt~Jaf$s!qnWL&^f4Bt?)YhFSyTsz`JDn-R# zt=R1mMgki`v*YPqxw%`fmW!)4RT?9|-$bjq8^LeafC!1PyTr26qE#AQ|A>=7&h>WS z-ywI#zpfiqBrKlQgvuN*UU3_A=N?F2%;Bv9Z{=&*(6{w2aJ2s3xq0p=^r(!#$ByUV zm~x_W;X5;1+8e3Hj+rot8432BwPfpSe7JI^R!bbTic!c`;5?kNCvo5Q!GV1(cl9?8 z%~<%!O5f%<@Y*WLlEg^EW@R0CQx)v^ZbChR;%YgUNYr%Ks>efn`jvG-T(N6$aQpU) zhTMS@FQ)HwAYEa6Se7d?1}_6LH+-3)X9X?Y(&Zbg6}Bns2he+9joMC>I&8s|kZbAE zx7QzZgz3;Ad?eV$%hBi-)fb@-pBo5M;^{LpL@)GqHZePcYoM7I56U#G@h5@9q`&eP z+@#3Pc)&3~gF!SJ<6C?(6R6^o3d#BxX?t6uMuklaNk2RVVUj;OIo^Lv8wIp*U(B>L z>{&Hb#h(j!wrkWhc}J8rG(3gp!p`7!C-#(vMDzUo<@qWp|3bw3dhdkNM!b1>xpa34 zMM)~Gi~;IV=oik>g7`7lHbYH8SQhPZxtdBh5I2=;*0KVj#P|Xc!2NK2)O#w`%d;;} zv>-to-7kVij~dS_wsNU-EavTbIW^f1-@-tmX(n`iY|qK-J^RZ0`tRS1fWDrw^ZsO; zp+Za(Un*kCXr4eUJdXVaiSKh6>hXiv5fCkDA`Ay#^mtOL5j{Og?(C`p(y6BAVOwlZE}u(kOBB-S^8~6yu*xvTn+6#@ zN2$Vj)+NiL8uk>v29kn@xN7{|_+;&_I}#!W;<5*~`Z^e0rr|g5PID&^tsp}i7yiOs zmk~LJ=V2E{G|=?8li$U2@9^;d;_NNM+WOjVUs~GI7B3Rqi@Q6;f3#ogWA-5qxNf1X#)d+oEYvrj(oAu_XAnM>xl@9`VxtLNgCi`iBSkJ}Lyk)t4u zZ+Z%MA>Huca2+4VBnPnuPoa(X<6z6GPE&g#5>+w0Iwp5&{zz242t7~5j{+z9o#ycR zwpdeUv}`05?dR#WvQo*;Gg52@915RV5jkMa^9`Wm`8~D`XEH zBjHCFug{+`dghdGOXEU2@UMARxY-}xp5GAr{4$>7d^v`H!N=}gad|r2jCf*$Scakf z4zIOo5ioo8ID_8fjape2Pu7Qg9)wTxh;Vv`d)9?6;o7%gje|R>{aL}ah9uFZgnzt{ zX+Db6Lv*e11kaLJeqKEL@~fEi-U0}*yjses2c@~^NR?U?PL2;UG5QftwlM@T5J(6xfhDLJCXIX|d8(+q2 zt0tA%%_(4llc`|Oxt`aNAk9CR(pSVlQJ$!eC>m@@(qW6@OOy`d(8xRa!#rWFy{2=_ z_Gpf3bFL+?nqml;&AhMlrQ^(9-+o_&n1U{5wzT{es3oT#G68i2vKS>dW~S8B5|EG- zeCSa80+J++1m2K2SCROdO?Y%s^=lfiN{+7a81NZGJ16*&v4osJ(&^M%&>`hCy6t*AdfeZ` zEA}F6X9d!zRQTMz#NTg(f`uWG~rS}O_q_*>n;T_?SX3d^8TvFUU z;Eqr9oEYSFdE>u^AQdP8}-R$VEp z+`K=j*kP~psa3^qaz8#k33mm8mrzSHKhv!{v#NtZc!nb@ocsy!6Tp&eFJ;x7I^w^@DPM(WxcOBWG}b_t&Q zrZM=_>p~0RVZE7Jx2NaeK!r?4lV~^6=BtFX_e5$lNo4^fUiLzT|GH+R2-=^!^*+^J#RYaGL0tkj7R2#xUccm zm~7SrQ1U5)H&lAFm&*M{^f6x z(L|`|G|#jDO1lvr+qa!_N(;hG0e4Rk@X2cxWm7VvJ!L3-7GUQR?()~j*FqHf4R|Y% zD?zd2!U>|8*|k}`XeX?@tC-PjvqWMN8wjZlq+8^7)q@M5!j!uAB`7=NvY64;Idyvt z-~)z@06-X0s=&~(ZoQB}>$ZT`>z4|M=Na3$h6td4Qnj@2kD{YNWV-7`DerFm#htiC zr-X+0D}J-pqH~-2dfTYl$gf9L8N5T8?O<5Hz#hWe-f%AAad-kR*P-u@)C?Zi_SXr^ z6}&+%F(ElQ4ZfL@npO6&POo(k?PW_*%hqqnEv{ayIE72+74ANly}|UW-+#Kq6^p6H zR2zqTUC!J>zMrf_(TvIgQ-bLp82nS)yt`lMQeJ8&eU`T$uJ=8uy}Nohx_O;`Z^>d7TBhSO(JtC+wDL(WE8i zv^)40Q4KX7GaNZq892;X4}DcAZclMSQ}Vg1@y{okq9ry}zY#l{VigzCS+obRs)W z?R^eX6f3k3l0kFgq?m|y5WbH6kbxoRrs6EWtg#z~k5%$|+iGD=k&=@Hb=I;XBHWf`CFrgr^P1icj#2k3ay*EvkwaS++V&D-W8P- z7{$|X5@*ZZ7cQKnm5Lj>YXZF!##X<~E5-M+cJ}e$8KR*z_NY}g8@cR+L&3NBMPiCo zCB-Rsmlrz~SuvXACGD?0(Q}peRF2A8;S2jB#|0Wv7w7MG3Gy_EVhhy5@VVm#gxR)9rLSo(c!Bd3F(IQ9B%KE7%7A*AXiy<2spWj46!)n;b6&Bu!b&X>?%hu3E5 zcE0hCL3P&g6SldzY+^zJ$(a}N$+s*<6*P#)H`R}lhW$?na?h1$Jth0RutWL(S&+NP z_*;+r?@Xz-_prZo2NGY8P#s0H!~rWeQtx0sVvn>Q*gTG5yvOBLd6pZX`wuNZ9t3l@ zBDjO_cZ~nmnOL5=7FLgUnishM;-RLxZMzt-hO$hof7ke2P597IEGds$6?>l^%k)Yo zdYn@K{qWCuN6`qboU_=_P(DvA2DraZm5g9uuYJF_BNe#$=L>9|K7rQ|PD4EpGll;p zslOaU3OFN9SL+~Ne*{4zI?Z}AJ4rkRXv@hq$A46y+)P=fS_1yP*8t;xE7>MniP3li zuo{t&>;0&2m5$pFRi6ZOIF~fI_6Po{Oty*<$8mKYePGMGiw#tLNTwfc^6bQudRGS%tZ1!>Q_t~jAOuC=&sN|Aad_-~bAQB$d`}-Bpz#Aygfd?Q2 zX8HUzb@VI|&H;zcc>6|X)RNFEJleATdz8+h<9{qwUTbK-5)+c%eA0;zM!PFh=N1zY zYl(13w3e;1|2xpn??ajdzwzShsO&aa` zu%P~7WMqp#Ma2bcxzFmT_(aq`AjvH&zNvN?4vE!bo!#{BNO#%+J7uht8!_>?g^!Sy z>jPsN{mb_gN8N{;zsMT@$9XE(Bc=m=5PWRIcNrf|^1bv&0|^}-a!0IjhsZsxLkD|Xx0%8$({evlf#yC%PY=Gb=d=q@7fM`7pc>CnHFgEcyYm63M@kIm_smwVUl zzTbZS=d+n=j5+P|rfB>s&cSQule*Pj|ZW9Y6&m+u8IEY1FIJY(n?W`17Yr{P~aty)j%+Czn?v>OUV?qL*6pmGx?V zsVP_f)DJ~14p|)7a zVI)I(cKVb`m@hv?^6AtrUvzv(MgCGMyzkrm9{CsdE>Slr86m^Q`x%z9ANkqLHcAYs7+OB!W@H%ZGs5y=-yKb`*;om`z&o8{w> zl|=p2_Yc}bvFUKs20{7cKGr#tpRwDFL%$pz!3H1eyG5-D|BI`XgG04so)8R-Ew-ej zB>&S{r@+%Xcws@&bY{pFLQYbidI80CygkQ`5XshZIIiw~Z>LX80Thas=+k6hy2pgJ z-x!xbbT;M9ezR~7o*$eD>j*fon*=r-ckZnG{{4HuG)T7K_1LDu$;nBhYzF$Mt7G?T z|2sEu-n|u6S64STr%oA;h>U!^AAL2su{VChLYR6VJ%{>XmDw9}B`yL%n){!wEJ5{d>#XNgNm0Y2-A(8B1d zU%7ipNwK`RJUDjJYQ14>r+shY`hrl&$xKa$2TkV+vu_Ht!koTRFoy1dZSXpiiOKpg z`A(H9qZk%Qh(r;3P-(IcSvkx(()SYm#W9x5L2-6HR(>LR6LW@=oFM7;NAAuJ-61G^ zMBS6WVm8!`FA1)?F>R(A7Rnu3qrTDlcUZD+G7;!K4D^8_^nY`l2??%(@}v@t3=Q)O z3JUT&D)OO-8mWp|NNw#}ax%{C@uD9+GOGy8PbtP~#Bs-=2d|MIv@@$OH|iQ1Dc$;3 zw|=X*A7G?ozY&R_Z`#iF_xHEmb<5!+!8N*$LAe?9^U`c0lN?R$YI=I-tFJE$igJ9) zT3UaRJIv^qn5}0W8H8?IzKR9(<$S(@&}J(|`Uc`g%4*J?(n8Y}E66gm9gf))I#A+i z7YGeH!y6t?9^pTS6ttoL-6(8FGsN-kw+c(XE{~RO#NpfjkOZ~eQ#{E~g z*;0%e;Oe&5XF^wsw|@_~KnR`B6-hN1z6+`@{AhgIt5yXfSkjhR2GP_9%7fG|HVX*KG$ z!Z}_*LRc#b0Q4a`O4rSHIKugA6T;7WZTG_!%q%P?Ew_3lPFOxT5~ao(3R zFw)RT2qL^Nbck=zpYm@eUF*-bjh$=R&^$ zg1b+RLjKCD2ThA_5lt~oXiqd>+Nz48Pr_=0Mrff7qUx*w@i#_QGia#bK8l|u|8^j#qa59+~b zE7b96xt){~aA{h;RDIrS72u`OZW$>(#G9!hC1fhiUJYwZT@|xsZzbM9f3bvnxpUku zp&>WKni#9R=;OXP`3Q#!qY5w$rf-L`d*scOR>{H%K$6|B*KP%Ff5N#Emg3WTvk|KkIuCJ5=oAiM45Ao zxrJDR(ayI6)ZUW6{KNqdeY#Gd5D;KsVAx%K^#=H)g2D0{i$4px%i9iDE^0025ZwKj z$-*+7wi)=tJF0G53hGcyK-VYx<*C|Nn}_zTrhIyWHC2OEyg--)5wC}K++&WEZLXf1ItOW=AZ_>UilUm0&EM&lCW@Vj)jKxC z2s{jp1hd1WdIgB-uH#QzE^bFP&I4JFZ)Q0Jl*L`@ELY2Ab(jUTg0JWvU!Ql|ntk-6 z_GIo3DPEiWL)BMWkA22%UQbsXxhqlc@lzs}eWPAVGOS(g+q|pTV9%ZzT~Z7G;EDj3 z8hfqN3E3{LT^8{_+LVl>E9fuyJud86^UgBtuu~$Zli+k+Ik`N@N#NrzzFdy_LBS{m zN)CYVA%7o<>HkEG@GkoQK0hX*XwaQr$Q>Jw44++CU}wzy#0!PDQv2QKc%0B^v?NRC z&pkG>TfKChIKCX6gs08VS{i+_((xW&S;}q-F6o(6EvIrl?Sho2VpxQbt9+t>B8W14 zOhHQm_;Ob+X-l^&hp#xZB-3rT-l`+X7+k64KCh#b1C@iAFGo2pr}3nht-U@^d#VXV z>Wnb00?@;K3_8gIqQy;PG?L!~QyK!TOdmLfsAdU);AwYw0E zQW%81`D|D<&Sd|e0UVUo>OruoMjLZ_los<NTr*rCDm&T6JZ3k{q_S+Haz_J+7JLJRHZ}~jCA=h zgE@d}ZvJbe2jyck)(&e*L9N2QRZ8SC`^DV+_4%qmA*nmY&T4Z^aK=^q=*smZ9rb$l zYTM%g4*2)cPB-XL0848^^BNLF;MKcr0>(93~c>A&+<>*JNZ;y%} z@`+)a)*eQN1-EnKjHy-y>@J9)1q`?SxfN2h9sFaN%+FiDq6BE9$zsd(#`LN5#?hH; zU0;es2Wi;Erzg;%arWGD}IMz9sO@$xPe0Ux$e;C-<5}({=*4xMyOK+q~qo<*j+QKUrX!rl&3iKio~k9hYRzRk(oRiQ)*Zf>k8vrzG_Nwc! zij~XcDtBsLOKslVj_X>BnnVY|D%+F}9XQDNiS6zV8iDiu;d#>>J0MO!9QDOPN-8vWHzVS~ z11+IUtI1N?E#_y45I7F+#!$qSX_u}wUK^Xw)Ff$6Xe)U|6;Fm4?$QJVqp5incgs7^Y;bLJPbY^J&oB9Z zTtVk$vV*D_o{Iqx>V$SPttm$dIxLv#e`aS{{Wt(f-oF#YEXhaZcIQUfbfReAjwn^$ zzv@I;R&cWA55`WlH5Tdm(|@pE?qxWnw)K?J_OgJ#?|8qF63RY(SWumNc_cy3&;v_NwO69$9`rq~F*!ghL?mIHUt%n<^1 z%aRlSh%B3^($i=*Avq~3hIXM(yIIsarY<$e>=OpzMr$W0q83w>xsDu}@M7*ba6bb` z+(f<@OCzY|Y#Y$0jT2#tDD)Wy;aZ&Rk0T)!%i&e-kBEqgVW4lFF5OSFa_AL3K9wX8 zu8R3<6?+j9&P?uRc!b9~_bSS1C(0V$(g?ihdW1R-Gn~+&McCMew5Qk7PM}*_Dci{fxcDlyVP1C=A)7-Mx9W<#&~&NmFpRpv zn$QtRqgCmsjOk$+^ftRHc9%htoZx*Eu(y!cj*-zdEhx_8f@_hT1-(&(&& z!6#)Lz2p8X27Z3W$+Q*%8zm7D2bV}-#p%Lrcmo92#)lQ>_==R}SDw>jFNO7k7j}#F z;Ej7|we64;UY6rlD~^xbQ$XiPjfTxHT0s2+bQck4DVH)1?c``mX~GbP!xaHP#Q+BaoMqRBsdM4&3L&~viPv((HWN9 zbhFc7G3q0D{wD)HCz47Y+Sh9*Ed*zC%A8ORHBf7W#QeVTZIjc)C3So5^wANxAe%$T zI&`Y$O9T#N1%mg<;?SrRC^y=cdU!6ZTogixxQ4A+Rq%QAnGwtv7T!iu9%MqmC z_V>lwK|-fX4&!$Y{Wa$YGWg_PQTaUV#^ddMX$i{uzH{J$C`doIcGTf*{C6qs(`jk0FSbn8ois4tZ_yFS>luCJ2 zKM3jHQG0e=%6QdOnON=+Xl{$_tSoK24C`N7nnv5{=_sLwTh!<@-t1-7DkFS72j5aF z8(Tlbu+0}EkhsAcvBaut6(2uk83cP49zCq(17*18KXHsyVA*sXt{Rc-!RqADb=>deU z(3PZ6Ib>Qa|4f{cgNm9ad9u=Hc4t?|jt9?XHDg6M)>Ak5g2-^}AdLH2@ez~jNAz)2Xox57P%3f-f^uYa@A)o-{$4~Edh9aQfFoI zb-aD0)i0i)AU2Sf2CZm6ddtVtaVQ+R9Mt_{(|Yf-_Zd||bXZ!iha4k0PF*$sD!FZC zIPnI_*%|%*J9Rj|gx(LY*6Kt_A;S-U-v9G`G@O@C%5FE$ou2w8Pe{6KcNkhlnxxVLKqAx&(8m&G-S6?V0fN1vzoDRby>_VUN+bXPtk61y9JnW(H%OBYS~550Az;Y_!0OW8cjk{Kud| zESw7x$s|aRwb$x_bGBMNI#lQZK=0{k(EX|zA^6z8kS}lb(-(}DeT5p`RLhWMwco(7 z46k23?;{TTgIoo6*h{>K)2?FrjRO0i!sKB2PeT5Twatpda{;KJx0;3TJd3nJzJmgW zY8_gXFaMHY{~%-jTO0cS7lsi;YG~K2wy7qsnki+UG7ho<4J}p|f$e7ZbX__I-n*|Z7!>tAV97quPjtZh)XY#PBQ-e?UWY3ui zgi1`j#LE;|Jt*De`J#5o6KG$&aN;$h;jb(YWAND`!8JRAzf2W7>@p^_`>o>z3Ggq@+Va9Ynuj4^qD;s=l#_OH8A(~$g}^3`Ek z$%xT#C)I29v$;@dL=$dx**XnIUWy(QtZA!bd~IVxX`p5^RQM6d@{1Xe2_`9O8lo?9 z9GYURqf9oKOm+4bg9=>AkprPyBo2{4sqirL(2i;HlAt8%Y=^#u*n-6}ev!?=&<(Yo z^hqZ_c7}M-%X^J4pIKt8tgXu|@}-zJjO;Ki#B|%uh{uy0D~j)v#s_1_OnT13@dGo# z?iIqb3!{VK@rcyn(dW_DG8zI<)l}0<$c&a6gbh~L)@(+29hAaknw$8TdwhudyAh9F z7&0@m;h(=qurl)hrjppC5CxI`Oc+KH_K`2 z#5rt&r&Ot1lXu1qSL>&e?Us2Fpeen$TnuUO{OB-mc`}a83Tt9XUm`zgQ(%h)aI*V3 zYczd>(9qInP`$v5!0t7X=T+C9P7fiXAyq!$o6M>f9DMgjnbNU0b=;q6$~G&T=;r9K zQ|0q}hTpx+%)e$1?Hikwcp;+sip?W>s%s)>4%|%sw}|i3>nq29g!X`BLor0{layYo z9$54YATs(Qze6s&m_Gu;>3@f z)Fr4s?V((-baI*Pl}+Tvbt5A`J+&D~*3ZmL8=JA%Cw`y~M&+A>y{vP_Bi@y^Tep}! zG;qQE!60*NV)L?2T%4F*;4ZiLIn;>)7W_&a6x3(F&V;oRb;-TU3I8hHt*bH+Al(Tpfo$`6Q@_zMB(Em_ChV$HC_Bo`HKcL5KR^? zjj^?Lp^k$qz1nG%3spn`z)dmxed&Rvx8r+cjd6L*5%>@}R!%bRSfF6JS_`l*G`QW` zcTyUPi)LOJ_AR(n)K5aHP65!ZgCB|bVb`e98{5H)#RNhQh8yh>Z*t(G3lWf}4Jzkr zR1`vj7cJNt_nxo_(nL}x8fE<0i5W=xk{aVanD2Z7VLe!Zs5$m8S|p zM@^YwVSm5FelRRi`6aqM7OPIqVBE9XUZP;u2ol@n$?Y}<+>j#kES?qUNFWahU03sv zbDsC_FDgTTiUSwyi>FIVOndLJ*d2bhL^aKlB505 z?nmj(x7a<#tJM6jL;dt4*E(ftt72g+xE!e?2FKI&yZJ_-W%`22^(rW*6skR+cVMAL zuUi`g9UnEM4HiPO@5Bj|Ih^?uD+|)`GNR?9BuL9=EG_qwRBVCUxm)OYVZ4>Msn%?= zd~FuLTQbs!M=A57mQ+%@Wy0z+&kbUJ)ZJj_bZ#o%nu_e(T@Y^!$h?E8Pxi0;!OJ@N z@4EbdRTNpe5&n_f7vDoAci2y4fA#F2DE|jx`~Rl+@t?yq9Qo&VJlg#>}HuS<^f3Ha>a+t1-{=OL+1R^ys`1!v2 z)?hqQfeR3cPM}kj&&ZB9oN)T|{5Fv~*ZVGYAe>=97KHZOwC|yvRp39g04p}rlw@2D zxU_cf?^v(z0Cb@QbBfa}M_*eL0xntl!-FCb^*_34kt@gc9wd*PqWENpYf1p+1Eo9k zqWG*!Bo-GIrgE!Eou8^M@S=ND{SKoi}u{NWZbKBCWjr|c!00t+P1#dC-6Eq1b zYUs=w_qbp)aM4gjtl!>6sl+-(3ALdr>trfgH`K5ELHN=or73 z&#nTLi|eLonb}Og*s#f7c@eG0tKgJyJLit`UdyfzTbLyjJscukUbzt1461Bh;zTIj z4sVTwzry&T2ygdb8WnV(|6qLzHD)SyS1)OT!(aJhLg0kQ=lDa+69;SJ=}^%UBPjX0 zOEn%lC0Z4o!cZ}KF#puNxI#gr#TVJcEuw3t6+Q#;vO+WNF~`lW#y56RwouDgwI8~b zd&R|^oWiR)fAZauiy4a9kXT92aO(5J7Md-FKDUgtBjrtR0aq~~5|hgZU6JsKXJ1L| z^1zqq%&4J~&Wi}{%2oyz8D7qiyXv)6A!~XYK3x-8g7N9C|IN6k~v>EgJ)~5amv{EBbc!)h(Q_vCD$n zH$%~Kx|`bx&|b0u(Qfvlxzx5WoI&)|RCK}BE`(*A+2>ZeQXe&V%&CILM*cK)qUc5 zCz7a5S8zpTSP-7|=)BQ#;DIoJx1v7oSvS<^EpxW$fQX~a>Jh#+^!|Y03jZRRjql~d zi@w8;oHFaneg-8V59sTcK|`UsVw;^3?~6JdJG6^|t-_M?z868baGC@=A!@!aFo+(e zAHk6ySm^0|3v8B@R{_C2S2%gv!qRfoR1!+~i&Cr(WZw2>Tus+BUv2Cnl7hMpRkn$w zZY8Qk+6^-AXY+_52V3nqhTY6yOo6njY8DlAQFR$@f|PEuMR#0_Vpb^XE#MXw7TLv6X%JaY$P;aDkV8mnG*K+mvTkrgUih7O1+F0kW3=_{2caAgORwV znk1fra=N7o8dE}bQ)S3daz+ZtNpVl&l{+3VJT|Q_uf$1~T8{bxhmD;dO$Iq2B@Ud( zu*uXy{uK6V8aaL}$GojLtnxW!IMZEvAjelSNqwvZN!x}jkg|-HLa>KK?Rr_6ZTRk< z1|-$2;~bkfY@F5JxGZ^*8nz`;`SZB8urVdF&YYfHnj#={>)z}W^Bef^Tqet*yC-|> zAX*LArnmDRk=7;C(f9T~zuv93uM{6V$ns7KMh^82eHVXc$$XK-eTz3shDjwtTXUz5 zeSuX>9l@$01}~UMODV&y^oU$SW^67mfp<=I{ct#Jp7;CAU6|Zxty6fr7hsgz_31p0 zvFb*}E6*_U9>(Q_yHp}QqnAaa-;#VXr-*anBs%T(ymK{&H9!cHDzgzWIik4dghjSO zpoC%yF=j*mp0y;uv2~idKb-==y!@X4P*>E{j{}av>pxOlguP$D_(b5B(rplpAR|T%*AQ|vRBDQZ z_-gAyu;{Q5!XUQOlMvtg^a5@`kq#|+sPL{! z`6s4P^*5J)C(q_q9%vjeUXCj(S6eo?X{-1ju3e&T(deF9Aha&4HQx-%@;T5dS2frL zcu$0Dr$Om7IhPx*WLmM#+;F-TY7K3&ocS7x-TE2FGhK2}Bd3;!ARMEX-g8hUprn^QfDSeS*Hu{58mh^H5!mn- zSGU85Mn~7(xIt=Eg0n!-Kwm~LhYDfQIFX);^9}EAWeC%}12vC&$L~7xve=`N#j(X8 z=2#HypS3;K<|348z8>f0d7H%9B6+obvoCK%4T#bglwh?3!bY*CF3ET!>lTT22FDzs zmc%E|72WA9YFH`lgfxLsw>_ejvFJix`l9u|ELmI{Dgglw*(M#cw2R?SjkB`GzuieI z(FQIJ(<6$@V71kZz13PT4@vRKUmv^c2p%80GE;)x^PFW4)7@D%dNGZRcW}c2)62r- zO>AY#)5Z)M3G8yvPWy86!=iGO^uw7h9_#?_`{fJ)_tbGN#a8@~;*Xmt4I?wEx6LJuk`^}#_m(l8rTDLJ zBBaTy-#Kp21_gT}2**HUI(p?ciDJ)#s}8=0gK)s{Wl4#~3(5j}f=bMx4A_>?HVVVR z%bobRqz?-;Gza~a^OxwKw1QHuSyE}9-_(B>-m*hr1t(o97%sJ2&-Sr?;bD$B#yet8 zd$dok!J)BhF4zlxs_o63mi&_YHl)8R@ho+LT&&bTAm1RwW}qtpG39qAZG_QbnJV`8 zBVKF)O)J71IpZquO))73H%ZMX<*-y|9EL|Dn=EsR42g4)2!@Egy9JUek6Q!O@nW~Y z2e_MwbZA!yw=Yh?@z^!l?M*gsF>A2&nvS+}!)Y=bOCJJ!mvD9_Lw4)uB}g%Jv~y!k z`CMTjm>EJr@SY^L$Wkr$Wv}v?Ji$}jI9bSm*N7K#FQK9J<$ri$U2;2v>&*fti}At- zQfUB}amE`dxKwEMY>1dulvY)B>K1HVNmSrV%VQbpaPNz13T8fgYwz@~h57>dP5tgf zIm;s1!=BoNtGN!MVK%xxU+GOD0L|W;4!)CW*2*)|_rgzMM)zE1GsVVm3>*TA`c}{G zqeL>m?qgvWoNyXV&wLLmWuQ0`-6&Qi z&^xn|Ca1gk=!T{ongoiZdK9fMG>%2Z7HnO_%{jFUOgbdlDScn+l+~tLgMA=Y)5qgq z8rtSkbuFN6q20MFJ^8ZPX5ZN;zlMGlGS*o=+xr0RX_-H+YijW=qx+#5CobySC2f&8 z=WHdc^Q6z~X3U?$lfz8ax82pFgpy9@;Ckkci~n1n5bt-7q=;pt|EcoyV)WfoDXZ*6 z$YBgHeU97ZSfEVcaXjA^jWoKrvUc%EWM{^_@;5@{87pw>Uv5FF>irMPYMShbYP}SV z{g!Iu!@e+MSqnb(9Q1wKhoXW9h^My1`6v4XT^iF7Jva6DmCSV$tPkGr8x77+_IJMB z*5o&_D=;&}$V_t<@KtSFuEOD*Slh&JNz6^LAI@PvrSaF@@ZEXrcCR+gX!qkaZx+S7 zx-9WK|JE*l<*!2G_zM<8N626FlAfa6y_Z6Hsj{E}Xk zNhr{)F))WMp1UxOh_5ffOt6XgU@Nla9cz?q8yNG6L2AXb)}+fF=McfS5Yz%H>F zDYB(zu$^Ze((77DobyT&i}=4?qZEO~&jwZ1fQS4rtNE$TY^0EH~CW)BYltFvK`Rpi&GPrQUh{J$at3u6$g^U5%@Tt8^af=XqH0rBo?) zCW}Mqg2eH^St%YVQ{O9xOfaGQVk+T&-J5agLv9 zZ|Q)Fg#<}TNY6WyP4#6v-0BjKx6f5KBPvFkAOry!W~O{CEnzt!k8+#+0$(_ONabCISC`#Ib(K1Z(&9Xd5NE0L#hdS+p7_KZ3lYrj4Q`^2GwfM3Tcm6+`# zwCR8PsDf-z(!p)sS-*ly&PF$~oXOMZLt1xk;>M?4ue8v)!3UL#Z&xiV26sM|67Mab z#JB%7>YZ87$dl8A`;VlDdMsHZ#}DVmpuAu^m?L>#i+2*MzeJ zt$6}Xm6|KXa!QD!u@S0f*Ky2XgVTq#n|Ni?zjc04w>qgbt1jwEmB(hSQZzvJ>}_$5 z#qHl?C2>8gKguCBID3_s*aAsK5GMZ#li~5HpdvSpawi=>D`J<*Txo{lfP{@VYuCwF z7!q9!U&W;*tc}&Pqk7$sb@}V)k!ifoalRv%JEh%^BEWi& zeLZ7k3q?cV%hTb21bcW@dA6F%I7PB{p`sQ2Nyja8J*Gy1Ot^NR)<^)w#QHB0lc^h78|0Eb4ReHY#peex%eVi4v0 zJ~$jKd!4EYNrJbORr?DSlMJq;MEMhw3 zTH~bprT;?<7%!14bhK!cp{5x~1a-1`p>d-JS71|}v2~7qXSfaC>{udr3h#})mEHK( zmyagqUD06B3&78*W{hP_$v^M9^WBN@j+c)D`0sztT(|Ht4rm-|rf zRl6@kpq8DqY@X&xTdcL18 zSjK4>Fpja_lY+n1dYmvgR?o^}dLMVI?Api}nfkgs2CGdCoA>_$ti# z$`qJL#k|oxFd&TMH{3axqyrQM_;!pckc~YYw3f3cr_8IkSHh%;Lt8$w5Pgn{dYd99FE{-Y*AT8itUD zU0b73y=E@i{`AD6@7NXyv85OlK-H*7!WFfOzU{?gIaYINcCr!eX!d-f%|x*^`}#6& z8ZH`oabeaE#$B-{uE_PAXUbRVaByYzb|e+coEPg9=Uw{j-hoE#O(tV|yy}r8VwnO( zcJ6bg$$w|4??7n$ITr8A#v+SYzN=yMQL9}8A7H1;598^uJY(CACzf>$T~887!i-f| zsrE%V&t1s#=5@a5ajkCrN%jm`5XPVAV>V@ov0_Dj5un6KB0*>2roMMFeScqihn+8N zKzW5;V)|I+px8d8_-OisP@~of;-u>2Bw>DIUZGIyV@;m2IBew{D`RcVVi)Pbd+glw zOfp!NoL~q}_!^Qg5kf-z@vR_CGhD8rR2{99d6A69>S%pF6$;F`(9@lV_RoT(QQFxW zc1U!`kPtsja`cWdN6w1;{`&Gd!#8;uqtN!<9C}ih)Fbp*162l-DWmfHC60yu8zfm` zzUs9TBsRdo0en9y1^$XqDY@)hZd{Kf>xjE9dq>X!?esRD7-RyTnKn-=M`yQ9@$SA6 zsQYH3#*Qqj`$H8U!=3Nk7Hd6Mq>{uhY}t$YGU-ZB-tPF#eZz2T(mWgI1ReAb{oV?6 zqp4MiCMUymkB=*-HUi%}nGt9>YBMr!#R>QP7;yZ|$E+Z8?Ytq=S27Cl4Ky;b@S z8p{K+)DE}C;+OL|K^kUAKS*7!(s<`HMNji)Sh?ri?TM+b|Rgj5gf*k#AMAy0KWbgl(yT4i+` zaB_ZU^b8&EP%x(X^-)JhN7a6LL0fXXp9S3^JA?AU#F72z$w>S6ZKuP2LZ_gi@3(z??g(5P$H}im~&{sBA;2|2G=b#;KWpSCNwYmgPT*Ox6@*)B}(&a z9fKZ)5Nm7hHO&tWtZ(Pd6+BM-)w{2{hDTW@`VE4RUD?Bw4B^=$$mEz5#K^**nYm^0>)HLSyPJj#P3ShEbhe4HNuwOsb0OyG>)pgM z9P;!^>vS_{DN^icc7qfIW@#!(3CFQ=G<#^ys$Jiu=vNSZode+*u&k>Z5LmAT!LL zT%W3%u+zhz7@5w0tHtrGJhH2NOK!nJxY}~>cKc`lvZbcV!_Cgl+I-8w$O?5xGg#}9 z=lHC@Q><DRF;St`3fyO4P_da2~%ShyHigb8XTCR0z0kk4Z>78Fs?6(V*g{lUscl;`Y4S>c6C* z8Rcs7+E#C1Hyws7Xe(e+w_MD6tu$7Y$2WVOcXSpMxWKCpIPfAy16|xV_W2M+DW*;N zvEnu?VsSM#uIx;EI-)jZo80I<=(62ZORx%hmnJ)X$<) z!vzFkaz(*>F@CC zu85I3K3RbF57c(BI|lL2@5hC_#XicW_T)b&Fd$pto!VCd;M_N)K*(DcsxzHktYBcy z7Epfmdhh?xb-TIABYVL4Q@-HS4+b}Q?8}|TXjL^?_|0nR-Rw|Qzk|7X&*ygede7ub zVQF;m`sn|M{*RW<-?EnSyZ*m+jc*uk!Z9p$=Ti;U6gW3Jq);0vOtap1Xs9y`%y-eK zf2?y#(ZyyT9n)9b!W5NN;@(AU86?_tGn4D(uC1;2wf~f>0_^6Wdhy*tB@SMI+#FytC(Ja<|aa=@sPR$KNkg`t%H+(W1L%3*+iAg~#o5u(mWEX_9F6 z+cY?pi$dnfl}rX_L5|?W@{-5Er-)_Nn>S`EjdIH6!PX&Gcb8BmZWBXs(fb0x{lAL) z>Y%p1_Rkb3Ep34UEn1+sLm^0UC|<0^-627O1osw-TY&<_ix&w_Xwc#W2o_w6YjM}j z_uYMeJM-@B?Cc*qJCljrdz0LI&bjCFJkNPPpQp^>V;Nbh!^!qzyzE^^`|_2?BO8v! zh__KJ<_~^PXno}23N20f8?P>z$?YW)nes_K;8>xtp0oTthe8gbkwMAY z);qw?!UG{OrA71ALs(Lj*A!35jlwggSNLh_c2H!bCt#|Yy+pW%EAIm*p_6KvMH@Xn z{|i1N=gNxfAFU?rgi5VqJ;O=@uk>|JmVr@?U1lFXfSd-(2%Ngd9Gc2L8WlgRiA>Uc zX1Wr8gH3xYgk8GBKImoCHz!+rcu?hZvn(vH-0f)EkUoJ2*p=ybB{@&K?${4}^MRuO z(jc<*&?{}h=e%A-7gWVZNZuV`5fbzmJt}`*n+&k@>pnkflKbyHGO*`;{3S^rm$I%~|-@Wx6-o!1*v0jv0v$yxTW+^?z z;;G!S?cThzei3K?bAvN$FX=xN4Ft1#+^e*zM!&N34CX|7WTcx+qu zVU?2p0n%3Ib;zniH}$i6r9rr>K=rQvG@iZp-VDlD$LqkM^mrk(zcBGK&8!p+Xv0{x zke@EeHREGOCfl!`B~2Ud*|(#I3vdH%v`Dvm6%nY>t| z+<-bsj2f8^4(cJK%L^u(F@|C7up-xxD$iIgZEWw_G8b37K<^yT-hwGmCPtHy^QSjV zF(qd!Yj{dxY=QMT;FGGhW{nN+EjXv}+_072;8MYpCq@_*?plS|vjj;zAxlotcGu@9 zQj}GXHD10_%f4LDZ&R&RNU2!RDob)7#@bs;pS!eVQ6sBZm@?D%wRPNez1&0)1{8Pq zNq$GIQp`fDfeqjMtM3P#UXg{DuO%Vu>yPp!{K~VtZ9uRsU!mOEnE{46cem&67+s?0 z059y+)Z(h*yN->;oi&I6j8nuVcxn4z$euN^L&72Ha%?cl=m9;UcfB}4o~uVi=M+yX zkfa=MHwYlaAz^XUhbcf_$llTTDzW)$=!D{%OEV7|f4v80K<eGjNv?!$WlF`4{3eGK&-zO0(Ao z`%pHDS_$YQ%t-)h&W{QI9SZ;eeu(TgjfexDu{gZ;Vi55CEW^XO~dZ zzKc?~K`t1o`5l?wV=~}fhaNDcX^1B)TEl{zUS0J9fmj{@rl{uU=T}xdg|Z)gehfGp)4{@kr4m$7 zBKG@ZfN!|`_rt@@_2bviANcZ63z84vJ#;b&>-^-+HnYD4-p)+h10 zB&k}UZ$ifHNf8-+ybOza7AB3O@$bnNnwlCSc|F~Q0?A;GYp&_S9QRM#`bs_jqAr2( zySu5!{91W~+tz3*utyc`x0Uf&7Eq}GrwR8ktDq^!*}2-kUAR983%m%#jKKM0g}@Vq z*6YUmTT*O#EF!>e2;^ZdwX_EmP!lBk*qH z{>bz$Dn5P*#uFli184+;K7$+2O7xHM;(CrdXzxr3X;ex}M0k05g@sd5HkflFz3^+< z+uJKI=T=IXnVr4+LwMJd`BIxG9AMVt!SNh2pTz=tx!-*LcVVHWBh0t4(f1}m64RzZ zD$GEMfRsB->xh~*uW03BZ5)YwAff3=i}AUr7JI>&O3L2>gH9tyfK^ zXKHm2{r%V5wBZSr(+i(LPu}{lJiHF?+kn8Y`Q6;Iz=u~f4DN(y4-@mUnfcRCX{fi0 zGih2f`1<;JEq>nnDI)k@_0RbI1UZMtnNliq&YW=N6x8282D-APjqTP^{SLbd#T`J# z_0)9rvFF2&Z(FwFN7z6T3uI3SYcHuDb`O8+N$tE)VRsr$dN@S0k5?{CuN)B{$Ku*0 zfaa1>?Y696neOX>z{xmvp3hvzWgnC<2(i-|r|OvGWH$IPP*&{H?+0#pnR294wFnZU zO`Di-03Ja^w+i%2Iu)#M1e>=>4!1-jjLg?yzop3hmH$M*N>dM!NVcxBCL#(k30A6e z1;@EQ?ZU@@{d?3ecBiYTOs%5FDf*a<471g{dMplW4^?XE)H^;#Q-~<>9E0k)$QoUE znKGws4!mv7Gq~c%L^~KrN{-<@i>?w5goNr6g1R1B_Q`=WAB;r$8zGLLY7p@x#NbF2NM78p>K`DGR1<#rH>)M(sYk~c0oA8$7 zQ0_-f%LS9>Xleo@PDnLh&-OAG^|*S#IGwFHeA~vZu-xULjOCNKehUIUGu1I}$!aIb zDa2`5LCL5s%mAXM-Q7IcLTAUK7`5`ilu_?(?AS>?mvQ||Q5X(rG|Om%KL6N-mD}5X zPdA)xcHL6Q=+m0l4=FRTUNvXj2Bl>#zBZaN;HHS-h-RJK`{?c2@uwyr)QG)~vHr_i z4E$5dtiOr~X*$D#N2+OkMw$`{LK~XAoG%s5>Pp%71yC_lsxs)nAe=ay4_EUxJRF$d ztNKZgf96R&T#%I`Gvo z;;=7Ow5u9QLyP4WXkU=aAHbhnIZRZ3eEV?9z3fH8v>#s$xb+WA%L8TTBT}H3uvnk= zThG8|@VTMwyN>WjH@kl9x^o92)?b*j&35`mvzP>_aI#N11%%_x4QFqbU0qNNkJ8E4 z0@zPK(8aX5Gb#1!fPl5{RF}bR0(`c4`Gs|+Vxf6VIbGE zHPA7Iwe2ikOfxxcqgCzcmv<~`9(aYxDk}Ku6&@>QT{6KSLfBv`P3xI$wGmIfO+!{@ zLxP?z@;R38$I{z#&{Rw@YO0_+y+re`GODFw+Vh6}-4vTzMpw3W?&1ZGG2$43%{oLhBM zPt7NNv<2p(BVYLIA7*(Vt5s2qLA@0oFtbg2i*lWHpoRUfJhjvYKGK-&1qNy=kF#ow zQ0p;PYlB)W+1uISY&Nl3c|idZO{L6%Mx+jWyqCq&6Z(z?^44q1q!QYwzPfgBy?8TG z;kT1c>*oEClD>Jz$M?lItyn_01G{&;oLB(g-&%>0#OX)j5VbKXjhw zzwH~l!d7h>p7C7QZ8?RR3eN^AuBHdwxhr&xB~sL|t#a8^E3*<}X$9*Vxvo3sB5yvZ zb2t@pkT`I~kBZ3TVB^*Ki6&*^rp>vP&jl&jquQGjpdiM)R1XKcLWJbpj;3Q7e!-eM zcOjq8Yx1+gJuCe5BvFGV*;Ex#*Q(Pt_-iCHIFXeBHyC0b&)I#-C0P)plfZO(m#o7E ztSWzVxohIp)W*y#>gUc0*QjEtJ;5iyZMLvMHEY>$iwGWl1^;}FJq7Gu@e*644XBT! zh-FGFSt9lSOIJaY9lIkB^B#vwo%q>!Ns=|+kmUnGTkPI$jsGG`%@#=*-S6a@{ z3!}gv+V5ABik{jck;?3bT3hl*H~v|pwxbi2k3e_qj&YNW)#d9ua!QV z_2Tj0u2rqESq}_`PtvN7Dhp1ttCP4ezCJ5EFq^<$ zp`l^$6^~~YA11_nbOvb5*{*G{65pCGBytE||# zb<)B5AtCfKrn%PKIlXP8i@J5d!H=0@7s7qtrubP$T3tl~cFa*yY%4%cphyzg;E_JL zYPTb356K4RvPd@b-jRnWeQI7O?(+GUvd8#?4xxYambCsaZN+Ic5tb1r5AU-bXcf1O z@(RNPfLMi=+rSnJL#&pow)Z~z8G0iShPE- zw!jyufAE{Yw*TxV$oua^Ub>LeU6|yx>DIS)DBQ})|CjO+hSwjMCE{L!5bmsYtfyLf z4Djf!c0kvzuM=kn2CQY@p#$HYg{H6IRQtYXdItoiL|vXP-kAm*C@)?PHh#VmxgrA3 z;e5)>AbVy}LVarF|wiG7xS4JQiTK0e+Sf zpP$ngh6*^A7v67P)B2w*2JA%t4)w_m5w5hvwY}E}w)c_z*pL zV0KQu1@YUUl6+k{vR)8ysv9`J@AQwah1x&A?RL6hp2lwUlle6J_e(#nsePWOI_>BK z!1cG*&k(Q!%OKa1;S;{vt|cy zPNa@6)!o$*Hwgl$bhjC)1p}%Eg5>U@!gBBWIf?7TTt(aRwW=fK5`TG%G+R-Gu0esF z+&$a|pRDxZd>EN?B5gc5ZWbwoF78pjbRVa|1ZLWN)tJ>O)&54T$6{3-@VbIem}BIg zD70IEG6wts$VGW`@&4ZqfuM0v9#I@_od!~0rr0ViRBp~e_*pV1I-f2{E*$$4 zERQbF>ie0U@Gzdxgv~M9FEW%nIh32y1$-G#`h+8D0?15=`{+#E>Y1!i_zD7WQz5-jD+0& zHLVDk+p;?%lb!{(!Gp+DLBVYumgm-d_=OCiM^dGom1-}kAlS|#6C(5WE<0j?GM^;> z!HklCqSPZKj;^p?GuV;xE~{DehgNK4K~i_Pdnx8-<|t?R9C6f>Yj?ODW&V2I!P9>hw;q_ zMtZ0KrbLH23uAKeVckVs$!pxCY6X<|&g)OppUG23z9CeT#a;G?w(>x9*b9dfd@ssY}6Vhr1?Ik>J4E ziG(G)z>Ruvf<0t6m!rBr=0}nz7@MvC@YRs+j3gdC1>mdhRYnc;g1sK_Z67)##wzRy zYA|Lp;1kF+e2_u)ID<^BM<6Xz*m?{axjskqfq$fm6aep9Gcdg>eQ{m(-mlt(G+VJC zf3vKOd$CAs&q)Va3;xR9Q+|}W4!0&l5$7xoXt#X)p@+EjTT3+N4)OtFE~QdG(Z=wV z0(P?goBpLJQbAY>rxX=WgsV^?B>CP$^juqbnnFFJ#a{mMjGa=$*y{}?z#&RAr0Z8? z@{*gWyNeiX)YG-L4D{mk{m56gX&%E6*M091cGAeMKKk+`IU}`QD9Kf_dCG?C@n9Z* zMu`B6WKEfcwV==p{{yowjwZU_#lstu%o=ljffTW1I;Pb$S^fA2 zr#S$t=NAHh{rIu^M&8HA25al_$n4OJGy<I^tLZf%lC_*Yb_ z8@9Tpd>{W-eQ!|%dX`6fYfFC^j+vd|3ULXNS0k-VzGf+jz|x;d4)!mK3-C z*V~w^c*Xif+CShoPy~5&0uDgbTHm8eZ@{XW4D*Me``ti#-wvk8Q>*%_rU59uKd;*| z*@Eyfwh{sF9wio_k^x><#vU=mbH5Rvu0}V`X;+x@6>`-^7;rfmcq?RRU?5kOjJe$K zLawfrn)|)Q+fAqYv(~TTn9yKqjS1+J3J)&bqff?K?5Uwyixy5mz^BQvJt6yY*6G5W zq>O89hZJl=E$mO!xx%TCt=jgopB#pMLAZe5J5fx&-D|lqL?X8enC1$8+S~;&qm>FF z#S8(dm;a7V{zp`+Q-GI<1#59)Z!~HM#LV1%e^qgh4tW}gDXF^Cv}AzLevZw_Li|bGl2pK0 znTxF^3NZyIozo@bYkJ`EDyF^*(-%1GQ-$RiGRt-%(kOnHL&e|gAo`6fZyH-!Dm(7= z;6qnk`4#W$wbBC|pP{;+rqKfq*6YRxL-&`hKNc6F$Rx8eGJ0(`km-XP_Pcv~mxG=y zhOC=`7h(6;I;7^)GgAGwRpqGwznI!Cgw~BK+GwV4;QH^oP@&%hxrYS5gwlRtd%Ht{cQtKoIp+)4XP|8Vt5Lak)Qjcu3-ka}o!IA&-?8 z_U>!S{oe~G!YeYy{@5nhOBV-=CWyl>l?e+yq2d5|vTA3wsXe9!mOPa-Sme^_4we1Y ze@p#t)znu^jH?zRVQ4HP`%_#BU=orxgMC8v>r(9c=AQ;2%{#;dt+RnTVB%CiF%O=+ z5!s@zN>;jyOZk7KbQMZDpNo^FQ?@3KgqZD%(#5j`(}q6&SjZhMW-Gg5=<~=o8mX+g zCND1^eR3`Yl9!CJTlS(>MBh0jGoot>fa47A?THfVIBVN{^(+ERYreg=y#_HJ35 zzx$Cx9>n_CX4#s{O+8&ecqVtU+e!egw)#*$o6D)>Hc0(rllTVx?iiTAaGJ(+5V`Er%+znqUnFvxv8fDN~4$A2)a6@$|KxzFb-DOW%KFe zY@3{YiFYkqpEJ?DNX zt>O3dtXHj>Y@qU{R}pTf7ffvv2|$kP>f{XsNoRNtFx~M$a3)?7bGOjmZZ0PHN5dc7 z&Q#ob(grr^dp;^|2?jKYVEV;-je;A~-40BY`vX~wphDh?L}!J`=OnEued{qvU&4v7 zdam33?6xhm=%D={@{2TS(-q}gzlP!VuDXghN4ve>`uo^x+Gr;KGNx5~n8wDP9#{PY z?t(nb?yPG_&dO=QXr6HvHai=Vn;gwpriAu;FAKiOV08g9kR?)XL}lQ4^0TeP#l(QP ztSsvNZ)M{D+TI-&zz1Pb~gEDcwoDh)Ou4m&0ZLB1p5c`=sQ?_%H z>J;E+cL0{M0z0lh^+By>ZfTiJ9v7!ZyrMdaNOzE;OX=f-HmZ;)77lKZ)xJPIz;PP3 zXLM2rk>YdliVHx(VVEFY^P42S0(m>%-Q47~pJO-0!ZAe6H_WsaVzH{IYU+K0voF!9 z@n7s(!N5(QnBC_5C48@t_Z)WeBhMJJQzJ%e2RNW#^uGMkH(>>#+ z9c21Pbk!?Tf5i8iP5?wt@eqn{2x-fNA0v; zvx4rf3eCOG{0sVq;9P00Z_?MR3e!FeVEDQ;>gz&kt^><`f-`c#I!1@DWW+T39dww?;G~l0*rwQUue*6h4RO>2 z#b@@0t8!KACd&bZoTeP(tyTP8+;;?uaAPZ0ljSU}OVZUUPYaS5EbSU>52+mB)?no% zRH1&3qbnB2fd%Xjwb&)9jRj~cf@0IPe@S7!LXr=uZu z^@Nh4hy8gGa@VPq%(X4z>kghVs zV;k)f!mJS!pR4A-Ztekj_E2!2+P=o zR9N;DqBGYH?57--&0-fcajG9`Tcg2s`sizVlNsSEBo_05VQy1dIl;A|f z2AOr&nWBQ?i|rd~Z0W4MFKU{!Y2j;7Zv&YgpIQHROyWn1&}L1P^>$ies>g`ORjGi| zU_L#n7yL5CSWO<^df}VFZCUQNoThS$DbISwonh?}M2BoPxVlI9NvIVaANXaC1@TCgWiJfM5XB!o}FbFHvua223 zqbJA^)3)D1Zf%}2&VyGLqJ7}!tLJXULML)4R!Pffm#7>P8EGfsMg2Y%6D2!1dE|-Q zU=o@|S=odZB@)&?hAtWDu(w6!_xPHOa7`O+wOW^+=O!BIPCizEmuQ~<*%wdAo$l$KnI(YV8C znset^-Lt#V!%C;?SuGRfa42ugv4{WpfSKM@0rlGLeul97%uwR(kF-Y;MH{E0!O|Qr z8+r47fQWb5;S%ID4#$&GV*7IuC51qsB|24ZF7p6~p@ER*r1o--ULmso>|OcW^I=6W z|Hq%gvr5d4Ts?Jv%fE_xf8$XB*YoX!U0BRF_jCr=QE}#q8?-@^>XR5+C{HXlUPgLm7 z;c3P`AvATf$Fdj_z)(ufP?tgFpdU@J*h@KUqy^rm-Nw`{%^C=xmdq?n*42agIZ>bv z7M`wi6ZTY(-(g68gd+r6u27u;)w{`T)r84xSQn46uYRE5#nr*12HZvb2p?`?$C@#n(#0o2xFKJKqLz!8DSPXqu5UHClElPR}RGb7C$4lknvxt4c(=DV@c*D za`*$)@Zotr}QhF!(MRRn|ti{n}?#eA80uyp}h3Im6^W%Jrlke4ON}k4Yz|U zPH!Xj2@p}Xw^2M%NeZ$(iCsOJ%Of^JIkf`GOwhb^bQA+g$mRGQNkk06Q^sJ8SRlJ0&^O){IhT$k=M!%F+v z#`h$-+$*FebD-I9CVE}OS?|@?0gCbYSI$rKYrnF~?!R)?uejzVN>_>Eq@rA2vUHWAEn@Mnf|Bx!ykRTKU|GCuU<)e|^zAy?;)h zQdcpF#P4qcuP6+# z`vL`xFZlgZEZn2D{-YVb0T^TQt0n8o&5p!+x*)wqW{DHLmHQY&!z zuf>Mfof0yxZ}FM#x~BN?2(u1G;H?3m53-^{P|Fj#m3_yjA%4{Z#Ky>IbyYPs!yR@; z95up_sFk%DQ3>ZOE2j?>_eih?gM+5kCbi4@GFT&}V{z-eJ5<4@VBwsePkr?Wt%5>q z)=`C$=tbX(~>K9dtMXvT8dIYw?R>0wGYHb)yedKWQ}CwPIL z_aYC+(M!*$-jdrs6;>}9O^BE}IO(gDQn7v`Q{kEgO--HEJgjY_+4MepuBtt&nfW!N zO+v<%IorXeqC1;$O39%RD)v*dMox~ghx&{P1$RNwoi5b7jJn~+vlu< z4~j0iVjSnEgdPcFf2$6KQRSysP0v=M!-#f;sn*fxkvJfGJeGg_g66_MTH$ zSE!bW=6BZC*lm4UC8aPVndd|KMKpeVZJS6Fm;%!uS{xY|cQGk=1NEOy01K{f>DQKb zLFg;}oqQ?XSGol(^;fSOy&L-D`j62D9eJ?wOSZo@g_taH^sH`2tes_QLbX|$DEE5J2?K%tjeS)i<1mIfw?d6Aj&)%ZAIOE2m zC~M1A=o*&gN^+?}Vx-%5*gsi;fyd7jZe z>-A(-*avq`P5{SVsu3!X;4)G5%kl%^F(tV-plsqFQm zH7YuqC7R5ExHvyLIA?B3d3JKHY;Lg{cGB1edk5;feCp}iF9wD)RuIPJQ{2Zdl-Jze6vR)hY!G}Lm#(*(0y8h`ol0j{B0Pckjnk$Uf8RQeRRsiObX#=dJxCegce{ibo$cR!qk;P_EK*?`>) z@I1zA!el~uOLoa5)GK|8#W)z&#C!N#>zT&fUs0bEhb5DC4gTxHvUmYw_gwT7eXXdK z^QgEa4e1(i@Ge89@NlQ|3FC<1d$i63hzf3AjBD;q*8epG@y-b36FYg^E@U@E1KYxH zu!lRB2+oC`W`BI&6SMWLV4I1_axO1ytY7e8XfTiSTexB(BYmV}oa5-?4-sTnWwg2* z7mvdSDiGJpeM#0q`vRlx?>WUF@fGv%%@s<0-*uCvDgzCTkchEui>7NXTFW7_y>2dT zR~to6^uV|(8QV{t&n`j{YI1C-)r4cFxEgjAHbyF@knvC=LL6DHMB`eB&(a8gfj0Z3 z;Nt}kT2V>ymngf3TqK$AN40(!#elgBtJBEAFh5Cer_zCeq8A%1i@j=HiE-L_U~t?@ z)z5b%d@gG)NpNA>xcUB)v~uR<2r&jhJWdyGXC7pCc@Lj=2j|aeJu$gbj|}i{j*;Tj zU%6y%OcLUmj0+wW2g|C^Cm~TK3269N*6A6CvL+iYAkENp?rwBs??G*>WGQQ!EorTh zSp3YvIwChAL(!_bL3+cRJY9`%LC4m9ejCyNrQEUlY%Zt7h_D*xM!3MEBs(c9Qq@kyWaW=GDyw+oV->LrPL1tvY&DlQHy$zh8iq8ybA zEWHpJd!MuZ?2P)l%TnXp&Tr8UYI9mhUYW`V+t(#c)hcTG1alhPph(0)cJk z{cN~uiH*+){HLmIa?KxCjGPKe*4&`KL+EK!WrrP(z zY+{Xd_ahuDCaFb!*PTQ{P$4^>S@uD5eS&2h@rc3Tn+H5KM_+CGm$R>lUuf0*c8W@NvP4wNghF$ddqz5AKamHTB}P_+HQNDsjB_f>BoqUJT&QB=IO%@g_#=( zpN}c`f*R^sFvw2#wymIQhmG(=F+~x@q=u1k_C7i&`}M&BNl}aY@|LV`7HFExiMVQ9 z&y7(Y{##Jz(OjOPghK|t7{PHb*Tag^D z{?_%ocK}ahL&5i^`p?#kxr1quf0_T5soRL1>4FXY)_Z3Q>YQLrwll&ow;!KRDWhSe zWLhcRP*oFpw3S*_sko43bDLS-Yr%5r4c%u~g|1si%JwLNGVir#dcw}ZQ#gV)GDq0d@j>_S#06lCSFJiS12^I35bufhl9_cjMi86QV*+Bcw6dKhKr z7+?F)x?;ANU2}tiVfpmR4GELndIY~k1!O_=)HiZZ-B)Pin6sO2J^F`+_0Inq-z!`W zw-Tt5gD1ZDcbg1YlU+)AMxCcFY7`Zb^LTsTnmaJ(Y}YP-BFRq?|Ix#3XAsX-?^c#x zw&6ZA%sAOXNA}%#G@97lSWT*4*zCQvy4xVM`Osu%PO#R|PMEScXT#u`(0qQy zz!(h+$T2R?9|}2Xp$pCEJ#2Q6d7y%p$k37vD)7FRNo_e9jpv=2)DV5YI~~X zJEy0U#LL%@I#*CCblP4&zLC_)yt}94)>@dxmcDalVIeBg+2Xhx)Uzq>{nb=m^EA5G zgTE1h->R;bVCCxWnD&xuTkU0gE|Px?@uZ~gRJ6C&fmdNJjNmAy$(7#6aGoQqzj8T_ zb8vr)0KpWGM}1U_SD;YCfkO3{*!s-jzhf&(2HS5nz0dcV5wl|(zf+-zd-d#S#zE}# zZHnP#%KJ{OLblD9r*j=;^J7GNU#E_m6CtYh3ispHc&gw6lD~7ieU2i{FUUs>TV_%l zqzo?#)WhoP5UJ5?PqQCi?|4rzT()z4_DPlxzL1TD{N3I@i=YWzk~RGW>)PV1Lo)Mf z{PH|-i>j^p^E>?W9^9d?l-zf&Rst!v$S8Z_!22grnRi_)I6Lo z4aj9QhTHD{Kxx%h2J$OYwF9X+ikMg=h1mO*7Ky&6%}$eWVdc~~4fsW_ z;UjSJ8xZvlaqBFm#tpyV0&Z8hgxS@Mee0}TWK>t`i(CKK>FfpjJBgX^7V(PXnC*la z;z4OTi|MTu#`;Gm)XRh(Nr4ZeJS^Tvb#sW9zTa-LhC?%@>sO0!^qX9V!UNYF+2D53 zYQG3*Uo46$rZ<-LP-s4F5X?YtWhl%=Yixz8Co*1tphj{zFo@>kbx);)v^d^%+7dzn z)$=2>e!urgj^bHd|B@BFjOfebXHMQ<(=iZ^N^7oE0c+^(`Dkm9?OFiy*#4QBoSt31 z<;pVBb+^pdWG7*hJaAz5X)G=E+#CShPOEhn)g?EuxK11J6`abiTJY7)6builD}<$% zGsqO-X3}UxOh?ZhR&%jhvG6E#U@v7IL&_TY2%zoy-kc&9Aq<$%Vq9f(j(u8k4D*&e zWds?7xMNJIdU9?{b04BX7XAwF{M-GT4U(1me(DNvHJ{|v>75Wm(uQnjcTbn%>Rc*; zfqWlRA|A|Ibe=M2TtR` zPK;u2$2=l=-BnEoP-S9s-GZaYjOP+}QCP5h)W~gQ($hC5WhT^?xD0DvJD6|X_%z+@ z`e;VP$|>otUL3-Y^7soSc@|@&`!45ZWVGDlMt|N_2|So+`|5{dY2UsBz&r(1s`vaW zZ(>UKKXNSo%{u;HQ!ozFQnQCH{9>$V?HwEjtoYK0EJ;)FewQAPI=%k)D(Ch$TQqp}nF%oPRQLW;bn%jVx~JuO z-t?lh^{OAWfgDo*k99T*M$kdp<;6<&izojOy!I3Qw=kKL*{jEWT~V}766x@_jkRwT z045K$Q*#!7qc)~D{>iquJCwW&hRLpEy134HbWdUZ#KNe%UN)b%_+xlvT>WFU1#4?U zt$|64`;tCxo3wWwi(I5Jw08$_@M=Zr{;_KjW9}Ef|JYj_c6FYpD|;LkxbAiQbNVqc zF)}hecO#OyBU3j^g!f-}@i82&3XU1(qouG`mGm3i<#!8iTW&rU%X_Bxr-4^n>h-$s zOOHeC*L0+xRbmoe&!Y9m+_>uU2e{WQW(}N8jWNryy;giHEBuuAYaV%r@PB7bf{!rE zO8>7@TmB<8^FI?~?lJnrfcyI_VeLT78{B`44Qv3+g$k++amAD|0sxfc)MU%wnFakf Dh(Tpk literal 0 HcmV?d00001 diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/provenance.json b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/provenance.json new file mode 100644 index 00000000..0f04e4b0 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/generated-mock-frontend/provenance.json @@ -0,0 +1,20 @@ +{ + "scope": "Actual rendered browser frontend with injected mock engine; no Windows or Linux guest acceptance", + "hashes": { + "docs/screenshots/01-launchpad.png": "3e9029c8eacd3ec2c693db5a162d30159dcee6c6dafbbb39c2bdf886e8244761", + "docs/screenshots/02-validation.png": "0f855b0817cab69a9cb7c3c83c3d42220466d8e30c74b4deb1478b677c9a3e9d", + "docs/screenshots/03-progress.png": "515d334b39ee9f39b1c43e37f363d045ef50f436f24c45ac34d94abb49e21d58", + "docs/screenshots/04-done.png": "f9bc9b3ffce131e37a20540d181133e386b7794d8331b2deff446beee0c4dfc6", + "docs/screenshots/05-control-panel.png": "5aa025518c15f369d15d70dac4af8a6f569f4f711a8aadad2baceacf02adc538", + "docs/screenshots/06-migration-dashboard.png": "56552dc838fd3fdc03bd4e0f12e0d1569d57c087df5417ef16d1b486bba5c33b", + "docs/screenshots/07-branded-bazzite.png": "54be93c103f9447be5d49b97add2111154a301df442ba100bf76cf1a44bbe7bb", + "docs/screenshots/07-branded.png": "340a7868c28ea5516400f17587cfc84930c025e4e481d17e7f062aab7c434d52", + "docs/screenshots/08-bitlocker.png": "783fc3c73834a6fd57f7dc60b848cd2c3d8b0d7b7b1765abc916b5cdabc8c36b", + "docs/screenshots/09-vm-mode.png": "3140d2e3b42828fb7a5e32764b4da425ef23c133f42254e1df687e53b2c3c70c", + "docs/screenshots/10-luks-encryption.png": "b4686e238adb5b6fc8a6882dff30fc033c8a9f8bc749d7404a0415b5994824e2", + "docs/screenshots/11-defrag-preflight.png": "21f26a04d74f16970bb68fd75f87c9a8ff4b2716eb429dc00777a7a5dc4be404", + "docs/screenshots/12-vm-unavailable.png": "b5e159bbd520240d151c35d473c639681cb7eeb73fed58da8698c95c617dcb5e", + "docs/screenshots/14-bare-minimum-form.png": "ca848ed4a9e7909fefe3c83e69cd9cae70314f8ab857965220cffd0d7be39398", + "docs/screenshots/15-vm-first-launchpad.png": "8653ce84f5f3d4701326ab401e9c661ec1298d4fad2c3161f3f36000aeebbc94" + } +} diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-go-controls.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-go-controls.log new file mode 100644 index 00000000..4ac4c216 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-go-controls.log @@ -0,0 +1,5 @@ +ok wootc 7.336s +ok wootc/internal/artifactauth 0.030s +ok wootc/internal/runtimebundle 0.080s +ok wootc/tools/gendto 0.007s +ok wootc/tools/signmanifest 0.011s diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-prose.log b/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-prose.log new file mode 100644 index 00000000..34648d3c --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/integrated-prose.log @@ -0,0 +1,42 @@ + 228 docs/agent-lessons.md + 227 docs/SPEC.md + 125 docs/phase2-attach-postmortem.md + 76 docs/borrowed-from-libertix.md + 70 docs/ntfs-on-linux.md + 65 docs/phase2-debug-plan.md + 64 docs/plugin-architecture.md + 62 docs/branding-and-distribution.md + 49 docs/gui-phase1-architecture.md + 46 docs/release-notes-v0.3.0-beta.md + 45 docs/manual-testing.md + 39 docs/philosophy.md + 34 docs/upstream-blessings.md + 32 docs/finish-plan.md + 31 docs/gui-walkthrough.md + 30 docs/session-migration.md + 29 docs/milestones.md + 27 docs/status.md + 24 docs/non-bootc-adoption.md + 23 docs/adr/0004-composefs-kernel-module-matching.md + 20 docs/alpha-adopter-program.md + 19 docs/branding.md + 18 docs/adr/0004-restore-vm-first-product.md + 17 docs/architecture-boundary.md + 15 docs/docs-truth-pass.md + 12 docs/adr/0002-hardware-preflight-bootc-matching.md + 12 docs/experiments/vm-helper-2026-09-26.md + 12 docs/prefilled-profile-testing.md + 9 docs/adr/0001-phase1-first-architecture.md + 9 docs/branded-walkthroughs.md + 9 CONTRIBUTING.md + 7 docs/plan.md + 6 docs/adr/0003-onedrive-files-on-demand-migration.md + 6 docs/vhdx-exploration.md + 4 docs/backend-contract.md + 4 docs/soak.md + 4 docs/systemd-boot.md + 1 docs/artifact-authentication.md + 1 docs/specs/migration-extensions.md + 1 docs/windows-state-trust.md + +1512 finding(s) across 40 file(s) diff --git a/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json b/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json index 5e3183f0..fcfd15d3 100644 --- a/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json +++ b/docs/experiments/evidence/2026-09-27-vm-current-integration/provenance.json @@ -26,6 +26,16 @@ "typed-drive-controls.log": "cf24b3887dfd86f5d5b0b08902370321269ffb205aebc998c531f80088e08c0b", "removed-guard-mutant.log": "e56510372206b0c7cae12d2288a4aebe3dca9beedbd469d7483764990f50c5d9", "full-frontend-controls.log": "03cfc7ab0999c83b4fc6316a1af8982ca4b29e30eb67ab28a08c35438de1ecaa", - "removed-guard-mutant.json": "c5af4b0b52b6ed8903fd43d1d65d193021bc35f63376642e4427877ae2518ce1" + "removed-guard-mutant.json": "c5af4b0b52b6ed8903fd43d1d65d193021bc35f63376642e4427877ae2518ce1", + "integrated-go-controls.log": "261d5a926edbadecfc9471f5793e390489bc1bf3ed1780b14f4e647fbaa04de3", + "integrated-prose.log": "9233fe5e6202ff272151a3f6374c2e9477434220cd2c52a701f060c16ad13f80" + }, + "sharedEnglishFindings": 1512, + "englishBudget": 1512, + "generatedMockFrames": 15, + "codeScopeMatches": { + "vmFiles": "each byte-identical to reviewed418 or422", + "runtimeInstaller": "byte-identical419", + "runtimeDoc": "one plain-English noun-cluster correction; technical claims unchanged" } } diff --git a/docs/experiments/windows-vm-runtime-2026-09-26.md b/docs/experiments/windows-vm-runtime-2026-09-26.md index 784a59e5..3b0e68cc 100644 --- a/docs/experiments/windows-vm-runtime-2026-09-26.md +++ b/docs/experiments/windows-vm-runtime-2026-09-26.md @@ -74,7 +74,7 @@ The extractor rejects links, extra or missing files, duplicate paths, difference in path case, Windows device names, alternate streams and paths outside the bundle. It writes to a private temporary directory and publishes through one rename. It refuses to change an existing runtime. Cancellation or a failed check removes temporary files. -A process crash can leave private temporary files; it cannot publish a partial runtime. +A process crash can leave private files in a temporary directory; it cannot publish a partial runtime. The real archive passed this installer on Linux and native Windows. Each run authenticated and installed 3,284 files, including the two manifest files. From baf2d401f6b455f882e079ecb7e6e5e735d9355d Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 14:59:51 +0000 Subject: [PATCH 25/33] Add typed scoped VM display operations on owned QMP pipes --- .github/workflows/vm-qmp-controls.yml | 46 ++++ app/vm_display.go | 327 ++++++++++++++++++++++++++ app/vm_display_test.go | 295 +++++++++++++++++++++++ app/vm_process.go | 47 +++- app/vm_qmp.go | 248 +++++++++++++++---- app/vm_qmp_native_test.go | 68 ++++++ app/vm_qmp_protocol_test.go | 72 ++++++ 7 files changed, 1043 insertions(+), 60 deletions(-) create mode 100644 .github/workflows/vm-qmp-controls.yml create mode 100644 app/vm_display.go create mode 100644 app/vm_display_test.go create mode 100644 app/vm_qmp_native_test.go create mode 100644 app/vm_qmp_protocol_test.go diff --git a/.github/workflows/vm-qmp-controls.yml b/.github/workflows/vm-qmp-controls.yml new file mode 100644 index 00000000..0a2ed034 --- /dev/null +++ b/.github/workflows/vm-qmp-controls.yml @@ -0,0 +1,46 @@ +name: Managed VM QMP component controls + +on: + pull_request: + paths: + - 'app/vm_qmp*.go' + - 'app/vm_display*.go' + - 'app/vm_process*.go' + - '.github/workflows/vm-qmp-controls.yml' + workflow_dispatch: + +permissions: + contents: read + +jobs: + controls: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-go@v7 + with: + go-version-file: app/go.mod + - uses: actions/setup-node@v7 + with: + node-version: 24 + - name: Install native component dependency + run: sudo apt-get update -qq && sudo apt-get install -y -qq qemu-system-x86 + - name: Build actual frontend for engine embed + working-directory: app/frontend + run: npm ci && npm run build + - name: Require native paused QEMU and source controls + env: + WOOTC_REQUIRE_NATIVE_QMP: '1' + run: | + set -o pipefail + mkdir -p "$RUNNER_TEMP/vm-qmp-controls" + go test -C app . -run 'Test(QMP|VMDisplay|ManagedVMShutdownContract)' \ + -count=1 -race -v | tee "$RUNNER_TEMP/vm-qmp-controls/controls.log" + - uses: actions/upload-artifact@v7 + if: always() + with: + name: vm-qmp-component-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ runner.temp }}/vm-qmp-controls/controls.log + if-no-files-found: error + retention-days: 30 diff --git a/app/vm_display.go b/app/vm_display.go new file mode 100644 index 00000000..9d881a9c --- /dev/null +++ b/app/vm_display.go @@ -0,0 +1,327 @@ +package main + +import ( + "bufio" + "context" + "crypto/rand" + "crypto/sha256" + "encoding/hex" + "encoding/json" + "fmt" + "io" + "os" + "path/filepath" + "strconv" + "strings" + "time" +) + +// This internal surface never exports raw QMP or guest execution. Display +// control does not prove Linux, session, editor, or desktop semantics. +type vmDisplayRequest struct { + RunID, InstallID, DiskID, SessionID, DirectiveID string + Action string + Keys []vmDisplayKey +} +type vmDisplayKey struct { + Code string + Down bool +} +type vmDisplayObservation struct { + RunID, InstallID, DiskID, SessionID, DirectiveID string + Action string + Running bool + Mice []vmDisplayMouse + CapturePath, CaptureSHA256 string + Width, Height int + DesktopQualified bool +} +type vmDisplayMouse struct { + Name string `json:"name"` + Index int `json:"index"` + Current bool `json:"current"` + Absolute bool `json:"absolute"` +} + +func freshVMSessionID() (string, error) { + var b [16]byte + if _, err := rand.Read(b[:]); err != nil { + return "", err + } + return hex.EncodeToString(b[:]), nil +} +func (s *vmSession) acquireOperation(ctx context.Context) error { + select { + case s.operationGate <- struct{}{}: + return nil + case <-ctx.Done(): + return ctx.Err() + } +} +func (s *vmSession) releaseOperation() { <-s.operationGate } +func (s *vmSession) displayIdentity(req vmDisplayRequest) error { + s.mu.Lock() + defer s.mu.Unlock() + select { + case <-s.done: + return fmt.Errorf("VM session exited") + default: + } + if s.state.Phase != vmRunning || s.sessionID == "" || req.SessionID != s.sessionID || req.RunID == "" || req.RunID != s.state.RunID || req.InstallID == "" || req.InstallID != s.state.InstallID || req.DiskID == "" || req.DiskID != s.state.DiskID { + return fmt.Errorf("display request does not match active VM identity") + } + return nil +} +func validDisplayDirective(id string) bool { + b, err := hex.DecodeString(id) + return err == nil && len(b) == 16 && hex.EncodeToString(b) == id +} +func strictQMPDecode(raw json.RawMessage, value any) error { + d := json.NewDecoder(strings.NewReader(string(raw))) + d.DisallowUnknownFields() + return d.Decode(value) +} +func (q *qmpClient) displayStatus(ctx context.Context) (bool, error) { + raw, err := q.request(ctx, "query-status", nil) + if err != nil { + return false, err + } + fields, shapeErr := decodeQMPObject(raw) + if shapeErr != nil || len(fields) != 3 || fields["running"] == nil || fields["singlestep"] == nil || fields["status"] == nil { + return false, fmt.Errorf("invalid status field shape") + } + var r struct { + Running *bool `json:"running"` + SingleStep *bool `json:"singlestep"` + Status string `json:"status"` + } + if err = strictQMPDecode(raw, &r); err != nil || r.Running == nil || r.SingleStep == nil || !*r.Running || r.Status != "running" { + return false, fmt.Errorf("VM is not positively observed running") + } + return true, nil +} +func (q *qmpClient) displayMice(ctx context.Context) ([]vmDisplayMouse, error) { + raw, err := q.request(ctx, "query-mice", nil) + if err != nil { + return nil, err + } + var rows []json.RawMessage + if err := json.Unmarshal(raw, &rows); err != nil { + return nil, err + } + for _, row := range rows { + fields, err := decodeQMPObject(row) + if err != nil || len(fields) != 4 || fields["name"] == nil || fields["index"] == nil || fields["current"] == nil || fields["absolute"] == nil { + return nil, fmt.Errorf("invalid mouse field shape") + } + } + var records []struct { + Name *string `json:"name"` + Index *int `json:"index"` + Current *bool `json:"current"` + Absolute *bool `json:"absolute"` + } + if err = strictQMPDecode(raw, &records); err != nil || len(records) == 0 || len(records) > 16 { + return nil, fmt.Errorf("invalid mouse inventory") + } + seen := map[int]bool{} + current := 0 + var out []vmDisplayMouse + for _, r := range records { + if r.Name == nil || *r.Name == "" || r.Index == nil || *r.Index < 0 || *r.Index > 32 || seen[*r.Index] || r.Current == nil || r.Absolute == nil { + return nil, fmt.Errorf("invalid mouse") + } + seen[*r.Index] = true + if *r.Current { + current++ + } + out = append(out, vmDisplayMouse{*r.Name, *r.Index, *r.Current, *r.Absolute}) + } + if current != 1 { + return nil, fmt.Errorf("ambiguous active mouse") + } + return out, nil +} +func displayKeyEvents(keys []vmDisplayKey) ([]any, error) { + if len(keys) == 0 || len(keys) > 64 { + return nil, fmt.Errorf("invalid key batch size") + } + allowed := map[string]bool{} + for _, k := range strings.Fields("a b c d e f g h i j k l m n o p q r s t u v w x y z 0 1 2 3 4 5 6 7 8 9 spc ret tab esc backspace delete left right up down home end pgup pgdn shift ctrl alt dot comma minus equal slash") { + allowed[k] = true + } + pressed := map[string]bool{} + events := make([]any, 0, len(keys)) + for _, key := range keys { + if !allowed[key.Code] || key.Down == pressed[key.Code] { + return nil, fmt.Errorf("invalid or unbalanced key event") + } + pressed[key.Code] = key.Down + events = append(events, map[string]any{"type": "key", "data": map[string]any{"down": key.Down, "key": map[string]string{"type": "qcode", "data": key.Code}}}) + } + for _, down := range pressed { + if down { + return nil, fmt.Errorf("key batch leaves a key pressed") + } + } + return events, nil +} +func (s *vmSession) observeDisplay(ctx context.Context, req vmDisplayRequest) (vmDisplayObservation, error) { + ctx, cancel := context.WithTimeout(ctx, 10*time.Second) + defer cancel() + var out vmDisplayObservation + if !validDisplayDirective(req.DirectiveID) { + return out, fmt.Errorf("invalid display directive identity") + } + switch req.Action { + case "status", "mice", "keys", "capture": + default: + return out, fmt.Errorf("unsupported display action") + } + if req.Action != "keys" && len(req.Keys) != 0 { + return out, fmt.Errorf("unexpected keys") + } + var events []any + var err error + if req.Action == "keys" { + if events, err = displayKeyEvents(req.Keys); err != nil { + return out, err + } + } + if err = s.acquireOperation(ctx); err != nil { + return out, err + } + defer s.releaseOperation() + if err = s.displayIdentity(req); err != nil { + return out, err + } + if s.displayDirectives[req.DirectiveID] { + return out, fmt.Errorf("display directive replay") + } + if len(s.displayDirectives) >= 4096 { + return out, fmt.Errorf("display directive limit") + } + s.displayDirectives[req.DirectiveID] = true + out = vmDisplayObservation{RunID: req.RunID, InstallID: req.InstallID, DiskID: req.DiskID, SessionID: req.SessionID, DirectiveID: req.DirectiveID, Action: req.Action} + if out.Running, err = s.qmp.displayStatus(ctx); err != nil { + return vmDisplayObservation{}, err + } + switch req.Action { + case "mice": + out.Mice, err = s.qmp.displayMice(ctx) + case "keys": + var raw json.RawMessage + raw, err = s.qmp.request(ctx, "input-send-event", map[string]any{"events": events}) + if err == nil { + var ack map[string]json.RawMessage + ack, err = decodeQMPObject(raw) + if err == nil && len(ack) != 0 { + err = fmt.Errorf("invalid key acknowledgment") + } + } + case "capture": + out.CapturePath, out.CaptureSHA256, out.Width, out.Height, err = s.captureDisplay(ctx) + } + if err != nil { + return vmDisplayObservation{}, err + } + if err = ctx.Err(); err != nil { + return vmDisplayObservation{}, err + } + if err = s.displayIdentity(req); err != nil { + return vmDisplayObservation{}, err + } + return out, nil +} +func (s *vmSession) captureDisplay(ctx context.Context) (string, string, int, int, error) { + root := filepath.Dir(s.statePath) + resolved, resolveErr := filepath.EvalSymlinks(root) + absolute, absErr := filepath.Abs(root) + if resolveErr != nil || absErr != nil || filepath.Clean(resolved) != filepath.Clean(absolute) { + return "", "", 0, 0, fmt.Errorf("capture parent must be canonical") + } + info, err := os.Lstat(root) + if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 { + return "", "", 0, 0, fmt.Errorf("invalid capture parent") + } + dir, err := os.MkdirTemp(root, ".capture-"+s.sessionID+"-") + if err != nil { + return "", "", 0, 0, err + } + success := false + defer func() { + if !success { + _ = os.RemoveAll(dir) + } + }() + path := filepath.Join(dir, "frame.ppm") + f, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + return "", "", 0, 0, err + } + if err = f.Close(); err != nil { + return "", "", 0, 0, err + } + raw, err := s.qmp.request(ctx, "screendump", map[string]string{"filename": path}) + if err != nil { + return "", "", 0, 0, err + } + ack, err := decodeQMPObject(raw) + if err != nil || len(ack) != 0 { + return "", "", 0, 0, fmt.Errorf("invalid screendump acknowledgment") + } + info, err = os.Lstat(path) + if err != nil || !info.Mode().IsRegular() || info.Size() <= 0 || info.Size() > 64<<20 { + return "", "", 0, 0, fmt.Errorf("invalid capture file") + } + f, err = os.Open(path) + if err != nil { + return "", "", 0, 0, err + } + defer f.Close() + h := sha256.New() + r := bufio.NewReader(io.TeeReader(io.LimitReader(f, 64<<20), h)) + magic, e1 := r.ReadString('\n') + dimensions, e2 := r.ReadString('\n') + depth, e3 := r.ReadString('\n') + parts := strings.Fields(dimensions) + if len(magic) > 16 || len(dimensions) > 64 || len(depth) > 16 || e1 != nil || e2 != nil || e3 != nil || magic != "P6\n" || depth != "255\n" || len(parts) != 2 { + return "", "", 0, 0, fmt.Errorf("invalid PPM header") + } + width, e1 := strconv.Atoi(parts[0]) + height, e2 := strconv.Atoi(parts[1]) + if e1 != nil || e2 != nil || width < 1 || height < 1 || width > 4096 || height > 4096 { + return "", "", 0, 0, fmt.Errorf("capture dimensions out of bounds") + } + n, err := io.Copy(io.Discard, r) + if err != nil || n != int64(width)*int64(height)*3 { + return "", "", 0, 0, fmt.Errorf("capture pixel count mismatch") + } + if err = ctx.Err(); err != nil { + return "", "", 0, 0, err + } + success = true + return path, hex.EncodeToString(h.Sum(nil)), width, height, nil +} + +// The future test-only RPC route must call this engine-owned path. It receives +// no pipe, socket, guest command, QMP command, or caller-selected capture path. +func (a *App) observeVMDisplay(ctx context.Context, req vmDisplayRequest) (vmDisplayObservation, error) { + a.vmMu.Lock() + session := a.vmSession + a.vmMu.Unlock() + if session == nil { + return vmDisplayObservation{}, fmt.Errorf("no VM session owned by this engine") + } + out, err := session.observeDisplay(ctx, req) + if err != nil { + return vmDisplayObservation{}, err + } + a.vmMu.Lock() + same := a.vmSession == session + a.vmMu.Unlock() + if !same { + return vmDisplayObservation{}, fmt.Errorf("engine VM session changed") + } + return out, nil +} diff --git a/app/vm_display_test.go b/app/vm_display_test.go new file mode 100644 index 00000000..1adf5da7 --- /dev/null +++ b/app/vm_display_test.go @@ -0,0 +1,295 @@ +package main + +import ( + "bufio" + "context" + "encoding/json" + "fmt" + "io" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +// Actual inherited-pipe child, not a VM. It exercises production QMP/capture +// consumers but cannot establish guest or desktop acceptance. +func TestVMDisplayChild(t *testing.T) { + mode := os.Getenv("WOOTC_DISPLAY_CHILD") + if mode == "" { + return + } + fmt.Println(`{"QMP":{"version":{},"capabilities":[]}}`) + r := bufio.NewScanner(os.Stdin) + for r.Scan() { + var req struct { + Execute string `json:"execute"` + ID string `json:"id"` + Args json.RawMessage `json:"arguments"` + } + if json.Unmarshal(r.Bytes(), &req) != nil { + os.Exit(9) + } + if path := os.Getenv("WOOTC_DISPLAY_SPY"); path != "" { + f, e := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) + if e != nil { + os.Exit(8) + } + fmt.Fprintln(f, req.Execute) + f.Close() + } + value := `{}` + switch req.Execute { + case "query-status": + if mode == "slow" { + time.Sleep(120 * time.Millisecond) + } + value = `{"running":true,"singlestep":false,"status":"running"}` + if mode == "paused" { + value = `{"running":false,"singlestep":false,"status":"paused"}` + } + if mode == "fake-status" { + value = `{"running":"true","singlestep":false,"status":"running"}` + } + case "query-mice": + value = `[{"name":"mouse","index":0,"current":true,"absolute":false}]` + if mode == "ambiguous-mice" { + value = `[{"name":"a","index":0,"current":true,"absolute":false},{"name":"b","index":1,"current":true,"absolute":true}]` + } + case "screendump": + var args struct { + Filename string `json:"filename"` + } + if json.Unmarshal(req.Args, &args) != nil { + os.Exit(7) + } + data := []byte("P6\n1 1\n255\nRGB") + if mode == "bad-pixels" { + data = []byte("P6\n1 1\n255\nR") + } + if mode != "missing-capture" { + if os.WriteFile(args.Filename, data, 0600) != nil { + os.Exit(6) + } + } + case "input-send-event": + var args struct { + Events []json.RawMessage `json:"events"` + } + if json.Unmarshal(req.Args, &args) != nil || len(args.Events) == 0 { + os.Exit(5) + } + if mode == "bad-key-ack" { + value = `{"delivered":true}` + } + } + fmt.Printf("{\"return\":%s,\"id\":%q}\n", value, req.ID) + if req.Execute == "system_powerdown" && mode != "hung-powerdown" { + fmt.Println(`{"event":"SHUTDOWN","data":{"guest":true,"reason":"guest-shutdown"}}`) + os.Exit(0) + } + } + os.Exit(0) +} +func displaySession(t *testing.T, mode string) (*vmSession, vmDisplayRequest, string) { + t.Helper() + dir := t.TempDir() + spy := filepath.Join(dir, "spy") + cmd := exec.Command(os.Args[0], "-test.run=^TestVMDisplayChild$") + cmd.Env = append(os.Environ(), "WOOTC_DISPLAY_CHILD="+mode, "WOOTC_DISPLAY_SPY="+spy) + state := VMState{RunID: "run", InstallID: "install", DiskID: "gpt", DiskPath: filepath.Join(dir, "root.disk"), Phase: vmReady} + s, err := startManagedVM(cmd, filepath.Join(dir, "state.json"), state, func() {}, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if err != nil { + t.Fatal(err) + } + t.Cleanup(func() { _ = s.force() }) + req := vmDisplayRequest{RunID: "run", InstallID: "install", DiskID: "gpt", SessionID: s.sessionID, DirectiveID: strings.Repeat("a", 32), Action: "status"} + return s, req, spy +} +func TestVMDisplayActionsAndSessionNonce(t *testing.T) { + s, req, _ := displaySession(t, "normal") + other, _, _ := displaySession(t, "normal") + if s.sessionID == other.sessionID || !validDisplayDirective(s.sessionID) { + t.Fatal("session nonce was reused") + } + for i, action := range []string{"status", "mice", "keys", "capture"} { + req.Action = action + req.DirectiveID = fmt.Sprintf("%032x", i+1) + req.Keys = nil + if action == "keys" { + req.Keys = []vmDisplayKey{{"ctrl", true}, {"s", true}, {"s", false}, {"ctrl", false}} + } + out, err := s.observeDisplay(context.Background(), req) + if err != nil { + t.Fatal(action, err) + } + if !out.Running || out.DesktopQualified || out.SessionID != s.sessionID { + t.Fatal("QMP observation became desktop qualification or lost identity") + } + if action == "capture" { + if out.Width != 1 || out.Height != 1 || len(out.CaptureSHA256) != 64 { + t.Fatal("unverified capture") + } + if !strings.HasPrefix(out.CapturePath, filepath.Dir(s.statePath)+string(os.PathSeparator)) { + t.Fatal("capture escaped owned directory") + } + } + } + if s.snapshot().DesktopReady { + t.Fatal("desktopReady became true") + } +} +func TestVMDisplayIdentityAndReplayRefuseBeforeGuest(t *testing.T) { + s, req, spy := displaySession(t, "normal") + before, _ := os.ReadFile(spy) + for _, which := range []string{"run", "install", "disk", "session", "directive", "arbitrary-action"} { + bad := req + switch which { + case "run": + bad.RunID = "old" + case "install": + bad.InstallID = "old" + case "disk": + bad.DiskID = "old" + case "session": + bad.SessionID = "old" + case "directive": + bad.DirectiveID = "../escape" + case "arbitrary-action": + bad.Action = "human-monitor-command" + } + if _, err := s.observeDisplay(context.Background(), bad); err == nil { + t.Fatal(which, "accepted") + } + } + after, _ := os.ReadFile(spy) + if string(after) != string(before) { + t.Fatal("refused identity reached guest") + } + if _, err := s.observeDisplay(context.Background(), req); err != nil { + t.Fatal(err) + } + before, _ = os.ReadFile(spy) + if _, err := s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("directive replay accepted") + } + after, _ = os.ReadFile(spy) + if string(after) != string(before) { + t.Fatal("replay reached guest") + } +} +func TestVMDisplayUnknownOrFailedObservations(t *testing.T) { + for _, mode := range []string{"paused", "fake-status", "ambiguous-mice", "bad-pixels", "missing-capture", "bad-key-ack"} { + t.Run(mode, func(t *testing.T) { + s, req, _ := displaySession(t, mode) + switch mode { + case "ambiguous-mice": + req.Action = "mice" + case "bad-pixels", "missing-capture": + req.Action = "capture" + case "bad-key-ack": + req.Action = "keys" + req.Keys = []vmDisplayKey{{"a", true}, {"a", false}} + } + if out, err := s.observeDisplay(context.Background(), req); err == nil || out.DesktopQualified { + t.Fatal("failed observation accepted") + } + }) + } +} +func TestVMDisplayKeyValidation(t *testing.T) { + for _, keys := range [][]vmDisplayKey{nil, {{"a", true}}, {{"a", false}}, {{"a", true}, {"a", true}}, {{"human-monitor-command", true}, {"human-monitor-command", false}}, make([]vmDisplayKey, 65)} { + if _, err := displayKeyEvents(keys); err == nil { + t.Fatal("invalid key batch accepted") + } + } +} +func TestVMDisplayDeadlineAndLifecycle(t *testing.T) { + s, req, _ := displaySession(t, "slow") + ctx, cancel := context.WithTimeout(context.Background(), 25*time.Millisecond) + defer cancel() + start := time.Now() + if _, err := s.observeDisplay(ctx, req); err == nil { + t.Fatal("blocking operation passed") + } + if time.Since(start) > 500*time.Millisecond { + t.Fatal("whole display deadline exceeded") + } + // Gate contention itself must honor the caller's deadline, without guest I/O. + s.operationGate <- struct{}{} + req.DirectiveID = strings.Repeat("b", 32) + ctx2, cancel2 := context.WithTimeout(context.Background(), 20*time.Millisecond) + defer cancel2() + if _, err := s.observeDisplay(ctx2, req); err == nil { + t.Fatal("gate contention passed") + } + s.releaseOperation() + s.mu.Lock() + s.state.Phase = vmStopping + s.mu.Unlock() + if _, err := s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("stop/input race accepted") + } +} +func TestVMDisplaySymlinkCaptureParentRefused(t *testing.T) { + s, req, _ := displaySession(t, "normal") + dir := t.TempDir() + link := filepath.Join(dir, "link") + if err := os.Symlink(filepath.Dir(s.statePath), link); err != nil { + t.Skip(err) + } + s.statePath = filepath.Join(link, "state.json") + req.Action = "capture" + if _, err := s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("symlink parent accepted") + } +} + +func TestVMDisplayEngineOwnerAndChangedSession(t *testing.T) { + s, req, _ := displaySession(t, "normal") + a := &App{} + if _, err := a.observeVMDisplay(context.Background(), req); err == nil { + t.Fatal("unowned session accepted") + } + a.vmSession = s + if out, err := a.observeVMDisplay(context.Background(), req); err != nil || out.DesktopQualified { + t.Fatal("engine route failed or qualified desktop", err) + } +} + +func TestVMDisplayForceRemainsAvailableDuringShutdownWait(t *testing.T) { + s, req, spy := displaySession(t, "hung-powerdown") + ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second) + defer cancel() + stopped := make(chan error, 1) + go func() { stopped <- s.stop(ctx) }() + deadline := time.Now().Add(time.Second) + for { + data, _ := os.ReadFile(spy) + if strings.Contains(string(data), "system_powerdown") { + break + } + if time.Now().After(deadline) { + t.Fatal("shutdown request never observed") + } + time.Sleep(time.Millisecond) + } + if _, err := s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("input accepted during shutdown") + } + start := time.Now() + if err := s.force(); err != nil { + t.Fatal(err) + } + if time.Since(start) > time.Second { + t.Fatal("force stop blocked behind guest shutdown wait") + } + if err := <-stopped; err == nil { + t.Fatal("forced stop became clean guest shutdown") + } + if s.snapshot().Phase != vmRecovery { + t.Fatal("forced stop lost recovery state") + } +} diff --git a/app/vm_process.go b/app/vm_process.go index 21ccbc45..e7f44cea 100644 --- a/app/vm_process.go +++ b/app/vm_process.go @@ -11,20 +11,27 @@ import ( ) type vmSession struct { - mu sync.Mutex - state VMState - statePath string - cmd *exec.Cmd - qmp *qmpClient - job io.Closer - done chan struct{} - release func() - forced bool - output *os.File + mu sync.Mutex + state VMState + statePath string + cmd *exec.Cmd + qmp *qmpClient + job io.Closer + done chan struct{} + release func() + forced bool + output *os.File + sessionID string + operationGate chan struct{} + displayDirectives map[string]bool } func startManagedVM(cmd *exec.Cmd, statePath string, state VMState, release func(), own func(*exec.Cmd) (io.Closer, error)) (*vmSession, error) { - session := &vmSession{state: state, statePath: statePath, cmd: cmd, release: release, done: make(chan struct{})} + sessionID, err := freshVMSessionID() + if err != nil { + return nil, err + } + session := &vmSession{sessionID: sessionID, operationGate: make(chan struct{}, 1), displayDirectives: map[string]bool{}, state: state, statePath: statePath, cmd: cmd, release: release, done: make(chan struct{})} session.state.Phase = vmStarting session.state.PID = 0 session.state.Error = "" @@ -119,6 +126,15 @@ func (s *vmSession) wait() { func (s *vmSession) snapshot() VMState { s.mu.Lock(); defer s.mu.Unlock(); return s.state } func (s *vmSession) stop(ctx context.Context) error { + if err := s.acquireOperation(ctx); err != nil { + return err + } + locked := true + defer func() { + if locked { + s.releaseOperation() + } + }() select { case <-s.done: if state := s.snapshot(); state.Phase != vmStopped { @@ -145,6 +161,9 @@ func (s *vmSession) stop(ctx context.Context) error { if err = s.qmp.command(ctx, "system_powerdown"); err != nil { return fmt.Errorf("request clean guest shutdown: %w", err) } + s.releaseOperation() + locked = false + // A force stop must remain available while the guest has not shut down. select { case <-s.done: state := s.snapshot() @@ -158,6 +177,12 @@ func (s *vmSession) stop(ctx context.Context) error { } func (s *vmSession) force() error { + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) + defer cancel() + if err := s.acquireOperation(ctx); err != nil { + return err + } + defer s.releaseOperation() select { case <-s.done: return nil diff --git a/app/vm_qmp.go b/app/vm_qmp.go index 534688df..5f0658d1 100644 --- a/app/vm_qmp.go +++ b/app/vm_qmp.go @@ -2,22 +2,29 @@ package main import ( "bufio" + "bytes" "context" "encoding/json" "fmt" "io" "strconv" + "strings" "sync" + "time" ) -// qmpClient owns a private inherited pipe pair. There is no public listener or -// command port for another user/process to connect to. +type qmpResult struct { + value json.RawMessage + err error +} + +// qmpClient exclusively owns the inherited pipes. No public listener exists. type qmpClient struct { input io.WriteCloser mu sync.Mutex - writeMu sync.Mutex + writeGate chan struct{} next uint64 - pending map[string]chan error + pending map[string]chan qmpResult done chan struct{} greeting chan error cleanShutdown bool @@ -25,11 +32,12 @@ type qmpClient struct { } func connectQMP(ctx context.Context, input io.WriteCloser, output io.Reader) (*qmpClient, error) { - q := &qmpClient{input: input, pending: map[string]chan error{}, done: make(chan struct{}), greeting: make(chan error, 1)} + q := &qmpClient{input: input, writeGate: make(chan struct{}, 1), pending: map[string]chan qmpResult{}, done: make(chan struct{}), greeting: make(chan error, 1)} go q.read(output) select { case err := <-q.greeting: if err != nil { + input.Close() return nil, err } case <-ctx.Done(): @@ -43,51 +51,156 @@ func connectQMP(ctx context.Context, input io.WriteCloser, output io.Reader) (*q return q, nil } +// Check duplicates recursively before decoding: encoding/json otherwise accepts +// last-wins fields, including the response identity and nested observations. +func qmpJSONValue(d *json.Decoder, depth int) error { + if depth > 32 { + return fmt.Errorf("QMP JSON nesting limit") + } + t, err := d.Token() + if err != nil { + return err + } + if delim, ok := t.(json.Delim); ok { + switch delim { + case '{': + seen := map[string]bool{} + for d.More() { + k, e := d.Token() + if e != nil { + return e + } + key, ok := k.(string) + if !ok || seen[strings.ToLower(key)] { + return fmt.Errorf("duplicate QMP field") + } + seen[strings.ToLower(key)] = true + if e = qmpJSONValue(d, depth+1); e != nil { + return e + } + } + case '[': + for d.More() { + if e := qmpJSONValue(d, depth+1); e != nil { + return e + } + } + default: + return fmt.Errorf("unexpected QMP delimiter") + } + end, e := d.Token() + if e != nil { + return e + } + if (delim == '{' && end != json.Delim('}')) || (delim == '[' && end != json.Delim(']')) { + return fmt.Errorf("invalid QMP delimiter") + } + } + return nil +} +func decodeQMPObject(data []byte) (map[string]json.RawMessage, error) { + d := json.NewDecoder(bytes.NewReader(data)) + d.UseNumber() + if err := qmpJSONValue(d, 0); err != nil { + return nil, err + } + if _, err := d.Token(); err != io.EOF { + return nil, fmt.Errorf("trailing QMP JSON") + } + var fields map[string]json.RawMessage + if err := json.Unmarshal(data, &fields); err != nil || fields == nil { + return nil, fmt.Errorf("QMP object required") + } + return fields, nil +} +func qmpString(raw json.RawMessage) (string, error) { + var s string + if err := json.Unmarshal(raw, &s); err != nil || s == "" { + return "", fmt.Errorf("QMP string required") + } + return s, nil +} func (q *qmpClient) read(output io.Reader) { scanner := bufio.NewScanner(output) scanner.Buffer(make([]byte, 4096), 1024*1024) first := true var readErr error for scanner.Scan() { - var packet struct { - QMP json.RawMessage `json:"QMP"` - ID string `json:"id"` - Event string `json:"event"` - Data struct { - Guest bool `json:"guest"` - Reason string `json:"reason"` - } `json:"data"` - Error *struct { - Class string `json:"class"` - Desc string `json:"desc"` - } `json:"error"` - } - if err := json.Unmarshal(scanner.Bytes(), &packet); err != nil { - readErr = fmt.Errorf("invalid QMP response: %w", err) + fields, err := decodeQMPObject(scanner.Bytes()) + if err != nil { + readErr = err break } if first { - if len(packet.QMP) == 0 { + greeting, err := decodeQMPObject(fields["QMP"]) + if err != nil || greeting["version"] == nil || greeting["capabilities"] == nil { readErr = fmt.Errorf("QMP greeting missing") break } + if len(fields) != 1 { + readErr = fmt.Errorf("ambiguous QMP greeting") + break + } first = false q.greeting <- nil continue } - q.mu.Lock() - if packet.Event == "SHUTDOWN" && packet.Data.Guest && packet.Data.Reason == "guest-shutdown" { - q.cleanShutdown = true + if event, ok := fields["event"]; ok { + name, err := qmpString(event) + if err != nil || fields["id"] != nil || fields["return"] != nil || fields["error"] != nil { + readErr = fmt.Errorf("invalid QMP event") + break + } + if name == "SHUTDOWN" { + var data struct { + Guest *bool `json:"guest"` + Reason string `json:"reason"` + } + if err = json.Unmarshal(fields["data"], &data); err != nil || data.Guest == nil || data.Reason == "" { + readErr = fmt.Errorf("invalid QMP shutdown event") + break + } + if *data.Guest && data.Reason == "guest-shutdown" { + q.mu.Lock() + q.cleanShutdown = true + q.mu.Unlock() + } + } + continue + } + id, err := qmpString(fields["id"]) + value, hasReturn := fields["return"] + fault, hasError := fields["error"] + if err != nil || hasReturn == hasError || len(fields) != 2 { + readErr = fmt.Errorf("ambiguous QMP response") + break } - if waiter, ok := q.pending[packet.ID]; ok { - delete(q.pending, packet.ID) - if packet.Error != nil { - waiter <- fmt.Errorf("QMP %s: %s", packet.Error.Class, packet.Error.Desc) - } else { - waiter <- nil + result := qmpResult{value: value} + if hasError { + var e struct { + Class string `json:"class"` + Desc string `json:"desc"` } + if err = json.Unmarshal(fault, &e); err != nil || e.Class == "" || e.Desc == "" { + readErr = fmt.Errorf("invalid QMP error") + break + } + result.err = fmt.Errorf("QMP %s: %s", e.Class, e.Desc) + } else if bytes.Equal(bytes.TrimSpace(value), []byte("null")) { + readErr = fmt.Errorf("null QMP return") + break + } + q.mu.Lock() + waiter, ok := q.pending[id] + if ok { + delete(q.pending, id) + waiter <- result } q.mu.Unlock() + if !ok { + readErr = fmt.Errorf("unmatched or replayed QMP response") + break + } } if readErr == nil { readErr = scanner.Err() @@ -98,7 +211,7 @@ func (q *qmpClient) read(output io.Reader) { q.mu.Lock() q.err = readErr for id, waiter := range q.pending { - waiter <- readErr + waiter <- qmpResult{err: readErr} delete(q.pending, id) } q.mu.Unlock() @@ -108,39 +221,76 @@ func (q *qmpClient) read(output io.Reader) { close(q.done) } -func (q *qmpClient) command(ctx context.Context, command string) error { +func (q *qmpClient) request(ctx context.Context, command string, args any) (json.RawMessage, error) { + switch command { + case "qmp_capabilities", "system_powerdown", "query-status", "query-mice", "screendump", "input-send-event": + default: + return nil, fmt.Errorf("unsupported engine QMP operation") + } + // All internal operations, including existing shutdown, have a bounded call. + ctx, cancel := context.WithTimeout(ctx, 10*time.Second) + defer cancel() + if err := ctx.Err(); err != nil { + return nil, err + } q.mu.Lock() if q.err != nil { err := q.err q.mu.Unlock() - return err + return nil, err } q.next++ id := strconv.FormatUint(q.next, 10) - waiter := make(chan error, 1) + waiter := make(chan qmpResult, 1) q.pending[id] = waiter q.mu.Unlock() - message, _ := json.Marshal(map[string]string{"execute": command, "id": id}) + defer func() { q.mu.Lock(); delete(q.pending, id); q.mu.Unlock() }() + message := map[string]any{"execute": command, "id": id} + if args != nil { + message["arguments"] = args + } + data, err := json.Marshal(message) + if err != nil { + return nil, err + } + select { + case q.writeGate <- struct{}{}: + case <-ctx.Done(): + return nil, ctx.Err() + } + if err = ctx.Err(); err != nil { + <-q.writeGate + return nil, err + } stopCancel := context.AfterFunc(ctx, func() { _ = q.input.Close() }) - q.writeMu.Lock() - _, err := q.input.Write(append(message, '\n')) - q.writeMu.Unlock() + n, err := q.input.Write(append(data, '\n')) stopCancel() + <-q.writeGate if err != nil { - q.mu.Lock() - delete(q.pending, id) - q.mu.Unlock() - return err + return nil, err + } + if n != len(data)+1 { + return nil, io.ErrShortWrite } select { - case err := <-waiter: - return err + case result := <-waiter: + if err := ctx.Err(); err != nil { + return nil, err + } + return result.value, result.err case <-ctx.Done(): - q.mu.Lock() - delete(q.pending, id) - q.mu.Unlock() - return ctx.Err() + return nil, ctx.Err() } } - +func (q *qmpClient) command(ctx context.Context, command string) error { + value, err := q.request(ctx, command, nil) + if err != nil { + return err + } + obj, err := decodeQMPObject(value) + if err != nil || len(obj) != 0 { + return fmt.Errorf("QMP command requires empty object acknowledgment") + } + return nil +} func (q *qmpClient) clean() bool { q.mu.Lock(); defer q.mu.Unlock(); return q.cleanShutdown } diff --git a/app/vm_qmp_native_test.go b/app/vm_qmp_native_test.go new file mode 100644 index 00000000..7d95229e --- /dev/null +++ b/app/vm_qmp_native_test.go @@ -0,0 +1,68 @@ +package main + +import ( + "context" + "encoding/json" + "io" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func TestQMPNativePausedComponent(t *testing.T) { + binary, err := exec.LookPath("qemu-system-x86_64") + if err != nil { + if os.Getenv("WOOTC_REQUIRE_NATIVE_QMP") == "1" { + t.Fatal(err) + } + t.Skip("native QEMU unavailable; no native protocol proof") + } + version, err := exec.Command(binary, "--version").Output() + if err != nil { + t.Fatal(err) + } + t.Log(strings.TrimSpace(string(version))) + root := t.TempDir() + cmd := exec.Command(binary, "-no-user-config", "-machine", "q35", "-accel", "tcg", "-S", "-m", "128", "-nodefaults", "-device", "VGA", "-display", "none", "-nic", "none", "-qmp", "stdio", "-monitor", "none") + state := VMState{RunID: "component", InstallID: "component", DiskID: "none-attached", DiskPath: filepath.Join(root, "unused"), Phase: vmReady} + s, err := startManagedVM(cmd, filepath.Join(root, "state.json"), state, func() {}, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if err != nil { + t.Fatal(err) + } + defer s.force() + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + raw, err := s.qmp.request(ctx, "query-status", nil) + if err != nil { + t.Fatal(err) + } + var status struct { + Running bool `json:"running"` + Status string `json:"status"` + } + if json.Unmarshal(raw, &status) != nil || status.Running || status.Status == "running" { + t.Fatal("paused component incorrectly running", string(raw)) + } + t.Log("actual paused status", string(raw)) + req := vmDisplayRequest{RunID: state.RunID, InstallID: state.InstallID, DiskID: state.DiskID, SessionID: s.sessionID, DirectiveID: strings.Repeat("c", 32), Action: "keys", Keys: []vmDisplayKey{{"a", true}, {"a", false}}} + if _, err = s.observeDisplay(ctx, req); err == nil { + t.Fatal("paused component accepted scoped input") + } + path, hash, width, height, err := s.captureDisplay(ctx) + if err != nil { + t.Fatal(err) + } + if hash == "" || width < 1 || height < 1 || !strings.HasPrefix(path, root) { + t.Fatal("native capture not verified") + } + t.Logf("actual native PPM %dx%d sha256=%s", width, height, hash) + if _, err = s.qmp.request(ctx, "screendump", map[string]string{"filename": root}); err == nil { + t.Fatal("actual native failed capture accepted") + } + if s.snapshot().DesktopReady { + t.Fatal("native paused component became desktop ready") + } +} diff --git a/app/vm_qmp_protocol_test.go b/app/vm_qmp_protocol_test.go new file mode 100644 index 00000000..44653903 --- /dev/null +++ b/app/vm_qmp_protocol_test.go @@ -0,0 +1,72 @@ +package main + +import ( + "bufio" + "context" + "fmt" + "io" + "strings" + "testing" + "time" +) + +func TestQMPTypedResponseCounterexamples(t *testing.T) { + for _, body := range []string{`{"id":"2"}`, `{"return":null,"id":"2"}`, `{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"}`, `{"return":{},"id":"2","id":"2"}`, `{"return":{"running":true,"running":false},"id":"2"}`, `{"return":{},"id":"unknown"}`, `{"error":{"class":"GenericError","desc":"failed"},"id":"2"}`} { + t.Run(body, func(t *testing.T) { + childIn, parentIn := io.Pipe() + parentOut, childOut := io.Pipe() + defer parentIn.Close() + defer childOut.Close() + defer parentOut.Close() + defer childIn.Close() + go func() { + fmt.Fprintln(childOut, `{"QMP":{"version":{},"capabilities":[]}}`) + r := bufio.NewScanner(childIn) + if r.Scan() { + fmt.Fprintln(childOut, `{"return":{},"id":"1"}`) + } + if r.Scan() { + fmt.Fprintln(childOut, body) + } + }() + ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond) + defer cancel() + q, err := connectQMP(ctx, parentIn, parentOut) + if err != nil { + t.Fatal(err) + } + if _, err = q.request(ctx, "query-status", nil); err == nil { + t.Fatal("invalid response accepted") + } + }) + } +} +func TestQMPBoundedBlockedWriteAndUnsupportedCommand(t *testing.T) { + childIn, parentIn := io.Pipe() + parentOut, childOut := io.Pipe() + defer childIn.Close() + defer parentIn.Close() + defer childOut.Close() + defer parentOut.Close() + go fmt.Fprintln(childOut, `{"QMP":{"version":{},"capabilities":[]}}`) + ctx, cancel := context.WithTimeout(context.Background(), 25*time.Millisecond) + defer cancel() + start := time.Now() + if _, err := connectQMP(ctx, parentIn, parentOut); err == nil { + t.Fatal("blocked write accepted") + } + if time.Since(start) > 500*time.Millisecond { + t.Fatal("blocked write exceeded bound") + } + q := &qmpClient{} + if _, err := q.request(context.Background(), "human-monitor-command", nil); err == nil { + t.Fatal("arbitrary QMP accepted") + } +} +func TestQMPDuplicateOrMalformedJSON(t *testing.T) { + for _, body := range []string{`{"return":{"x":1,"x":2}}`, `{"a":1} {"b":2}`, `null`, `[]`, strings.Repeat("[", 34) + strings.Repeat("]", 34)} { + if _, err := decodeQMPObject([]byte(body)); err == nil { + t.Fatal("ambiguous JSON accepted", body) + } + } +} From 2ddd0c6664c242d474f0a6265ed6e6592e8d9922 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:10:53 +0000 Subject: [PATCH 26/33] Bound retained display evidence across VM launches --- app/vm_display.go | 89 ++++++++++++++++-- app/vm_display_test.go | 99 ++++++++++++++++++++ docs/experiments/vm-scoped-qmp-2026-09-27.md | 41 ++++++++ 3 files changed, 219 insertions(+), 10 deletions(-) create mode 100644 docs/experiments/vm-scoped-qmp-2026-09-27.md diff --git a/app/vm_display.go b/app/vm_display.go index 9d881a9c..234f2644 100644 --- a/app/vm_display.go +++ b/app/vm_display.go @@ -195,6 +195,13 @@ func (s *vmSession) observeDisplay(ctx context.Context, req vmDisplayRequest) (v if err = s.displayIdentity(req); err != nil { return out, err } + if req.Action == "capture" { + if _, count, bytes, err := s.captureInventory(); err != nil { + return out, err + } else if count >= vmCaptureCountLimit || bytes >= vmCaptureBytesLimit { + return out, fmt.Errorf("retained capture budget exhausted") + } + } if s.displayDirectives[req.DirectiveID] { return out, fmt.Errorf("display directive replay") } @@ -234,15 +241,12 @@ func (s *vmSession) observeDisplay(ctx context.Context, req vmDisplayRequest) (v return out, nil } func (s *vmSession) captureDisplay(ctx context.Context) (string, string, int, int, error) { - root := filepath.Dir(s.statePath) - resolved, resolveErr := filepath.EvalSymlinks(root) - absolute, absErr := filepath.Abs(root) - if resolveErr != nil || absErr != nil || filepath.Clean(resolved) != filepath.Clean(absolute) { - return "", "", 0, 0, fmt.Errorf("capture parent must be canonical") + root, count, retained, err := s.captureInventory() + if err != nil { + return "", "", 0, 0, err } - info, err := os.Lstat(root) - if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 { - return "", "", 0, 0, fmt.Errorf("invalid capture parent") + if count >= vmCaptureCountLimit || retained >= vmCaptureBytesLimit { + return "", "", 0, 0, fmt.Errorf("retained capture budget exhausted") } dir, err := os.MkdirTemp(root, ".capture-"+s.sessionID+"-") if err != nil { @@ -270,8 +274,8 @@ func (s *vmSession) captureDisplay(ctx context.Context) (string, string, int, in if err != nil || len(ack) != 0 { return "", "", 0, 0, fmt.Errorf("invalid screendump acknowledgment") } - info, err = os.Lstat(path) - if err != nil || !info.Mode().IsRegular() || info.Size() <= 0 || info.Size() > 64<<20 { + info, err := os.Lstat(path) + if err != nil || !info.Mode().IsRegular() || info.Size() <= 0 || info.Size() > vmCaptureBytesLimit || retained+info.Size() > vmCaptureBytesLimit { return "", "", 0, 0, fmt.Errorf("invalid capture file") } f, err = os.Open(path) @@ -325,3 +329,68 @@ func (a *App) observeVMDisplay(ctx context.Context, req vmDisplayRequest) (vmDis } return out, nil } + +const vmCaptureCountLimit = 8 +const vmCaptureBytesLimit int64 = 32 << 20 + +func (s *vmSession) captureInventory() (string, int, int64, error) { + parent := filepath.Dir(s.statePath) + resolved, err := filepath.EvalSymlinks(parent) + absolute, absErr := filepath.Abs(parent) + if err != nil || absErr != nil || filepath.Clean(resolved) != filepath.Clean(absolute) { + return "", 0, 0, fmt.Errorf("capture parent must be canonical") + } + root := filepath.Join(parent, "captures") + if err = os.Mkdir(root, 0700); err != nil && !os.IsExist(err) { + return "", 0, 0, err + } + info, err := os.Lstat(root) + if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 { + return "", 0, 0, fmt.Errorf("invalid capture namespace") + } + f, err := os.Open(root) + if err != nil { + return "", 0, 0, err + } + defer f.Close() + names, err := f.Readdirnames(vmCaptureCountLimit + 1) + if err != nil && err != io.EOF { + return "", 0, 0, err + } + if len(names) > vmCaptureCountLimit { + return "", 0, 0, fmt.Errorf("retained capture count exceeded") + } + var retained int64 + for _, name := range names { + parts := strings.Split(name, "-") + if len(parts) != 3 || parts[0] != ".capture" || !validDisplayDirective(parts[1]) || len(parts[2]) > 10 { + return "", 0, 0, fmt.Errorf("unknown capture directory") + } + if _, err = strconv.ParseUint(parts[2], 10, 32); err != nil { + return "", 0, 0, fmt.Errorf("unknown capture suffix") + } + dir := filepath.Join(root, name) + info, err = os.Lstat(dir) + if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 { + return "", 0, 0, fmt.Errorf("invalid retained capture directory") + } + directory, openErr := os.Open(dir) + if openErr != nil { + return "", 0, 0, openErr + } + files, err := directory.Readdirnames(2) + directory.Close() + if (err != nil && err != io.EOF) || len(files) != 1 || files[0] != "frame.ppm" { + return "", 0, 0, fmt.Errorf("unknown retained capture files") + } + info, err = os.Lstat(filepath.Join(dir, "frame.ppm")) + if err != nil || !info.Mode().IsRegular() || info.Size() <= 0 || info.Size() > vmCaptureBytesLimit { + return "", 0, 0, fmt.Errorf("invalid retained capture file") + } + retained += info.Size() + if retained > vmCaptureBytesLimit { + return "", 0, 0, fmt.Errorf("retained capture bytes exceeded") + } + } + return root, len(names), retained, nil +} diff --git a/app/vm_display_test.go b/app/vm_display_test.go index 1adf5da7..f105389b 100644 --- a/app/vm_display_test.go +++ b/app/vm_display_test.go @@ -293,3 +293,102 @@ func TestVMDisplayForceRemainsAvailableDuringShutdownWait(t *testing.T) { t.Fatal("forced stop lost recovery state") } } + +func TestVMDisplayCaptureRetentionExhaustion(t *testing.T) { + s, req, spy := displaySession(t, "normal") + req.Action = "capture" + retained := map[string][]byte{} + for i := 0; i < vmCaptureCountLimit; i++ { + req.DirectiveID = fmt.Sprintf("%032x", 100+i) + out, err := s.observeDisplay(context.Background(), req) + if err != nil { + t.Fatal(err) + } + data, err := os.ReadFile(out.CapturePath) + if err != nil { + t.Fatal(err) + } + retained[out.CapturePath] = data + } + root, count, bytes, err := s.captureInventory() + if err != nil || count != 8 || bytes > vmCaptureBytesLimit { + t.Fatal("retained files unbounded", root, count, bytes, err) + } + before, _ := os.ReadFile(spy) + req.DirectiveID = strings.Repeat("d", 32) + if _, err = s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("exhausted capture count accepted") + } + after, _ := os.ReadFile(spy) + if string(after) != string(before) { + t.Fatal("exhausted budget reached QMP") + } + for path, data := range retained { + got, err := os.ReadFile(path) + if err != nil || string(got) != string(data) { + t.Fatal("prior proof changed") + } + } + // A new launch nonce must not reset the retained byte/count inventory. + ctx, cancel := context.WithTimeout(context.Background(), time.Second) + defer cancel() + if err = s.stop(ctx); err != nil { + t.Fatal(err) + } + cmd := exec.Command(os.Args[0], "-test.run=^TestVMDisplayChild$") + cmd.Env = append(os.Environ(), "WOOTC_DISPLAY_CHILD=normal", "WOOTC_DISPLAY_SPY="+spy) + next, err := startManagedVM(cmd, s.statePath, s.snapshot(), func() {}, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if err != nil { + t.Fatal(err) + } + defer next.force() + if next.sessionID == s.sessionID { + t.Fatal("reused launch nonce") + } + req.SessionID = next.sessionID + before, _ = os.ReadFile(spy) + if _, err = next.observeDisplay(context.Background(), req); err == nil { + t.Fatal("restart reset capture budget") + } + after, _ = os.ReadFile(spy) + if string(after) != string(before) { + t.Fatal("restart exhaustion reached QMP") + } +} +func TestVMDisplayActualRetainedByteBudget(t *testing.T) { + s, req, spy := displaySession(t, "normal") + root, _, _, err := s.captureInventory() + if err != nil { + t.Fatal(err) + } + dir := filepath.Join(root, ".capture-"+s.sessionID+"-1") + if err = os.Mkdir(dir, 0700); err != nil { + t.Fatal(err) + } + path := filepath.Join(dir, "frame.ppm") + f, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600) + if err != nil { + t.Fatal(err) + } + if err = f.Truncate(vmCaptureBytesLimit); err != nil { + t.Fatal(err) + } + f.Close() + _, count, bytes, err := s.captureInventory() + if err != nil || count != 1 || bytes != vmCaptureBytesLimit { + t.Fatal("actual file bytes not measured", count, bytes, err) + } + before, _ := os.ReadFile(spy) + req.Action = "capture" + if _, err = s.observeDisplay(context.Background(), req); err == nil { + t.Fatal("exhausted byte budget accepted") + } + after, _ := os.ReadFile(spy) + if string(before) != string(after) { + t.Fatal("byte exhaustion reached QMP") + } + info, err := os.Stat(path) + if err != nil || info.Size() != vmCaptureBytesLimit { + t.Fatal("prior evidence deleted or changed") + } +} diff --git a/docs/experiments/vm-scoped-qmp-2026-09-27.md b/docs/experiments/vm-scoped-qmp-2026-09-27.md new file mode 100644 index 00000000..117f1f7c --- /dev/null +++ b/docs/experiments/vm-scoped-qmp-2026-09-27.md @@ -0,0 +1,41 @@ +# Scoped QMP source controls — 2026-09-27 + +This source extends the managed engine from candidate `8e1c93e`. +It includes main `347f696`. It does not change the runtime or image. +The engine remains the sole owner of its inherited QMP pipes. +There is no new listener or public command endpoint. + +| Boundary | Source behavior | +|---|---| +| Replies | Typed return/error; duplicate fields, absent return, null, unknown IDs and replay refuse | +| Calls | Ten-second maximum; context-aware write gate; short writes and timeout refuse | +| Session | Fresh nonce per process launch; persisted install/run/GPT identity remains separate | +| Display route | Internal engine method; exact session/directive identity; no raw QMP or guest command | +| Query | Successful typed running state and strict mouse inventory | +| Keys | Bounded enum; balanced press/release batch; exact successful acknowledgment | +| Capture | Engine selects private path; verifies PPM header, dimensions, pixels and SHA-256 | +| Retention | Actual inventory across launches; eight captures and 32 MiB maximum; exhaustion refuses before QMP | +| Cleanup | Only failed fresh capture directory; prior proof remains until explicit consumer release | +| Lifecycle | Display actions serialize with stop/force; explicit force remains possible during guest shutdown wait | +| Desktop | Always unqualified; process/QMP/framebuffer cannot establish editor or guest identity | + +The API defines replies with types for status, mice and input events. +It defines PPM as the default capture format, with an empty acknowledgment on success. +[QEMU 8.2 QMP reference](https://qemu.readthedocs.io/en/v8.2.10/interop/qemu-qmp-ref.html#screendump-command). + +The approved native control uses QEMU 8.2.2 with TCG and `-S`. +It uses 128 MiB, no attached disk, no network and no guest installation. +The actual status was `prelaunch`, with `running` false. +The engine verified an actual 640×480 PPM and rejected a failed capture command. +This proves the protocol component only. It does not prove execution of a guest CPU or desktop acceptance. + +The child processes use inherited pipes to exercise the actual engine. +Their simulated status/editor context cannot qualify a real guest. +The old parser accepted a matching capability ID without a return field. +The control for the old source fails. The current control passes. +Controls also fail if I remove guards for replies, sessions, active state or pixels. + +The internal route still needs an RPC adapter for tests. Review that adapter separately. +No channel exists for current guest semantics. +Real Windows/WHPX execution, ordinary-user GNOME identity, and editor save/close/reopen remain open. +The full persistence gate must use the same installed disk and firmware across a clean stop and restart. From 35eb03bc6fe5eb67f95b440d8aa00b1e4f25b9f0 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:14:51 +0000 Subject: [PATCH 27/33] Exercise changed engine ownership and preserve typed shutdown observations --- app/vm_display_test.go | 26 +++++++++++++++++++++++++- app/vm_qmp.go | 5 +++++ 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/app/vm_display_test.go b/app/vm_display_test.go index f105389b..e4bfd067 100644 --- a/app/vm_display_test.go +++ b/app/vm_display_test.go @@ -257,6 +257,29 @@ func TestVMDisplayEngineOwnerAndChangedSession(t *testing.T) { if out, err := a.observeVMDisplay(context.Background(), req); err != nil || out.DesktopQualified { t.Fatal("engine route failed or qualified desktop", err) } + slow, slowReq, spy := displaySession(t, "slow") + a.vmMu.Lock() + a.vmSession = slow + a.vmMu.Unlock() + result := make(chan error, 1) + go func() { _, err := a.observeVMDisplay(context.Background(), slowReq); result <- err }() + deadline := time.Now().Add(time.Second) + for { + data, _ := os.ReadFile(spy) + if strings.Contains(string(data), "query-status") { + break + } + if time.Now().After(deadline) { + t.Fatal("current status query never issued") + } + time.Sleep(time.Millisecond) + } + a.vmMu.Lock() + a.vmSession = nil + a.vmMu.Unlock() + if err := <-result; err == nil { + t.Fatal("changed engine owner accepted stale session response") + } } func TestVMDisplayForceRemainsAvailableDuringShutdownWait(t *testing.T) { @@ -330,7 +353,8 @@ func TestVMDisplayCaptureRetentionExhaustion(t *testing.T) { } } // A new launch nonce must not reset the retained byte/count inventory. - ctx, cancel := context.WithTimeout(context.Background(), time.Second) + // The race-instrumented child spends one second in its exit hook. + ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second) defer cancel() if err = s.stop(ctx); err != nil { t.Fatal(err) diff --git a/app/vm_qmp.go b/app/vm_qmp.go index 5f0658d1..e78dcb45 100644 --- a/app/vm_qmp.go +++ b/app/vm_qmp.go @@ -152,6 +152,11 @@ func (q *qmpClient) read(output io.Reader) { break } if name == "SHUTDOWN" { + dataFields, shapeErr := decodeQMPObject(fields["data"]) + if shapeErr != nil || len(dataFields) != 2 || dataFields["guest"] == nil || dataFields["reason"] == nil { + readErr = fmt.Errorf("invalid QMP shutdown field shape") + break + } var data struct { Guest *bool `json:"guest"` Reason string `json:"reason"` From 21dd1da601ac0c0e221a5c686213e41d7ed21dbb Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:15:28 +0000 Subject: [PATCH 28/33] Pin literal typed guest shutdown fields with counterexamples --- app/vm_qmp_protocol_test.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/vm_qmp_protocol_test.go b/app/vm_qmp_protocol_test.go index 44653903..c375e69f 100644 --- a/app/vm_qmp_protocol_test.go +++ b/app/vm_qmp_protocol_test.go @@ -70,3 +70,13 @@ func TestQMPDuplicateOrMalformedJSON(t *testing.T) { } } } + +func TestQMPShutdownNeedsLiteralTypedFields(t *testing.T) { + for _, data := range []string{`{"Guest":true,"reason":"guest-shutdown"}`, `{"guest":true,"Reason":"guest-shutdown"}`, `{"guest":"true","reason":"guest-shutdown"}`, `{"guest":true,"reason":"guest-shutdown","reason":"host-qmp-quit"}`} { + q := &qmpClient{pending: map[string]chan qmpResult{}, done: make(chan struct{}), greeting: make(chan error, 1)} + q.read(strings.NewReader(`{"QMP":{"version":{},"capabilities":[]}}` + "\n" + `{"event":"SHUTDOWN","data":` + data + "}\n")) + if q.clean() { + t.Fatal("malformed shutdown became clean guest stop", data) + } + } +} From b6c4c6f02c31beaa248daaaefd456e04625fb429 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:19:50 +0000 Subject: [PATCH 29/33] Clear inherited desktop flags before any managed VM session --- app/vm_display_test.go | 15 +++++++++++++++ app/vm_process.go | 2 ++ 2 files changed, 17 insertions(+) diff --git a/app/vm_display_test.go b/app/vm_display_test.go index e4bfd067..b16b9f0e 100644 --- a/app/vm_display_test.go +++ b/app/vm_display_test.go @@ -416,3 +416,18 @@ func TestVMDisplayActualRetainedByteBudget(t *testing.T) { t.Fatal("prior evidence deleted or changed") } } + +func TestVMDisplayNeverInheritsDesktopClaim(t *testing.T) { + root := t.TempDir() + cmd := exec.Command(os.Args[0], "-test.run=^TestVMDisplayChild$") + cmd.Env = append(os.Environ(), "WOOTC_DISPLAY_CHILD=normal") + state := VMState{RunID: "run", InstallID: "install", DiskID: "gpt", DiskPath: filepath.Join(root, "root.disk"), Phase: vmReady, DesktopReady: true} + s, err := startManagedVM(cmd, filepath.Join(root, "state.json"), state, func() {}, func(*exec.Cmd) (io.Closer, error) { return noopVMJob{}, nil }) + if err != nil { + t.Fatal(err) + } + defer s.force() + if s.snapshot().DesktopReady { + t.Fatal("incoming state became live desktop proof without guest semantics") + } +} diff --git a/app/vm_process.go b/app/vm_process.go index e7f44cea..ff79637d 100644 --- a/app/vm_process.go +++ b/app/vm_process.go @@ -32,6 +32,8 @@ func startManagedVM(cmd *exec.Cmd, statePath string, state VMState, release func return nil, err } session := &vmSession{sessionID: sessionID, operationGate: make(chan struct{}, 1), displayDirectives: map[string]bool{}, state: state, statePath: statePath, cmd: cmd, release: release, done: make(chan struct{})} + // No guest semantic channel exists: never inherit a desktop claim from disk. + session.state.DesktopReady = false session.state.Phase = vmStarting session.state.PID = 0 session.state.Error = "" From 4cbdf3867f739d6a33585784fb7330184f80a2e2 Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:24:29 +0000 Subject: [PATCH 30/33] Document the absence of inherited desktop authority --- docs/experiments/vm-scoped-qmp-2026-09-27.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/experiments/vm-scoped-qmp-2026-09-27.md b/docs/experiments/vm-scoped-qmp-2026-09-27.md index 117f1f7c..dbded44b 100644 --- a/docs/experiments/vm-scoped-qmp-2026-09-27.md +++ b/docs/experiments/vm-scoped-qmp-2026-09-27.md @@ -5,6 +5,9 @@ It includes main `347f696`. It does not change the runtime or image. The engine remains the sole owner of its inherited QMP pipes. There is no new listener or public command endpoint. +The live session clears `DesktopReady` at start. +A record on disk cannot replace current guest semantics. + | Boundary | Source behavior | |---|---| | Replies | Typed return/error; duplicate fields, absent return, null, unknown IDs and replay refuse | From c9b60777cfac4f721a25994b05c78a796ab63e2f Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:24:30 +0000 Subject: [PATCH 31/33] Retain scoped QMP native and guard-counterexample provenance --- .../2026-09-27-scoped-qmp/.gitattributes | 1 + .../2026-09-27-scoped-qmp/actionlint.log | 0 .../actual-retained-bytes-mutant.log | 6 + .../capture-budget-before-qmp-mutant.log | 6 + .../capture-pixels-mutant.log | 18 +++ .../current-missing-return.raw.log | 4 + .../engine-owner-after-response-mutant.log | 6 + .../2026-09-27-scoped-qmp/full-go-b6.raw.log | 5 + .../2026-09-27-scoped-qmp/full-go21dd.raw.log | 5 + .../guard-mutations.json | 107 ++++++++++++++++++ .../inherited-desktop-after.raw.log | 4 + .../inherited-desktop-before.raw.log | 6 + .../initial-race-fixture-deadline.raw.log | 76 +++++++++++++ .../missing-return-counter-test.go | 7 ++ .../missing-return-mutant.log | 20 ++++ .../old-counter-provenance.json | 18 +++ .../old-missing-return.raw.log | 6 + .../evidence/2026-09-27-scoped-qmp/prose.log | 42 +++++++ .../2026-09-27-scoped-qmp/provenance.json | 62 ++++++++++ .../2026-09-27-scoped-qmp/race-b6.raw.log | 78 +++++++++++++ .../2026-09-27-scoped-qmp/race21dd.raw.log | 76 +++++++++++++ .../running-observation-mutant.log | 18 +++ .../session-correlation-mutant.log | 6 + 23 files changed, 577 insertions(+) create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/.gitattributes create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/actionlint.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/actual-retained-bytes-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/capture-budget-before-qmp-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/capture-pixels-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/current-missing-return.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/engine-owner-after-response-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/full-go-b6.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/full-go21dd.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/guard-mutations.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-after.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-before.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/initial-race-fixture-deadline.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-counter-test.go create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/old-counter-provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/old-missing-return.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/prose.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/race-b6.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/race21dd.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/running-observation-mutant.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/session-correlation-mutant.log diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/.gitattributes b/docs/experiments/evidence/2026-09-27-scoped-qmp/.gitattributes new file mode 100644 index 00000000..817a7482 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/.gitattributes @@ -0,0 +1 @@ +*.log -text diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/actionlint.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/actionlint.log new file mode 100644 index 00000000..e69de29b diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/actual-retained-bytes-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/actual-retained-bytes-mutant.log new file mode 100644 index 00000000..97044d24 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/actual-retained-bytes-mutant.log @@ -0,0 +1,6 @@ +=== RUN TestVMDisplayActualRetainedByteBudget + vm_display_test.go:403: actual file bytes not measured 1 0 +--- FAIL: TestVMDisplayActualRetainedByteBudget (0.02s) +FAIL +FAIL wootc 0.028s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-budget-before-qmp-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-budget-before-qmp-mutant.log new file mode 100644 index 00000000..eaaf790c --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-budget-before-qmp-mutant.log @@ -0,0 +1,6 @@ +=== RUN TestVMDisplayCaptureRetentionExhaustion + vm_display_test.go:347: exhausted budget reached QMP +--- FAIL: TestVMDisplayCaptureRetentionExhaustion (0.05s) +FAIL +FAIL wootc 0.059s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-pixels-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-pixels-mutant.log new file mode 100644 index 00000000..500e0ffc --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/capture-pixels-mutant.log @@ -0,0 +1,18 @@ +=== RUN TestVMDisplayUnknownOrFailedObservations +=== RUN TestVMDisplayUnknownOrFailedObservations/paused +=== RUN TestVMDisplayUnknownOrFailedObservations/fake-status +=== RUN TestVMDisplayUnknownOrFailedObservations/ambiguous-mice +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-pixels + vm_display_test.go:197: failed observation accepted +=== RUN TestVMDisplayUnknownOrFailedObservations/missing-capture +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-key-ack +--- FAIL: TestVMDisplayUnknownOrFailedObservations (0.19s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/paused (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/fake-status (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/ambiguous-mice (0.03s) + --- FAIL: TestVMDisplayUnknownOrFailedObservations/bad-pixels (0.02s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/missing-capture (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-key-ack (0.03s) +FAIL +FAIL wootc 0.203s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/current-missing-return.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/current-missing-return.raw.log new file mode 100644 index 00000000..788ee3f4 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/current-missing-return.raw.log @@ -0,0 +1,4 @@ +=== RUN TestMissingCapabilityReturnMustRefuse +--- PASS: TestMissingCapabilityReturnMustRefuse (0.00s) +PASS +ok command-line-arguments 0.010s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/engine-owner-after-response-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/engine-owner-after-response-mutant.log new file mode 100644 index 00000000..4b232c01 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/engine-owner-after-response-mutant.log @@ -0,0 +1,6 @@ +=== RUN TestVMDisplayEngineOwnerAndChangedSession + vm_display_test.go:281: changed engine owner accepted stale session response +--- FAIL: TestVMDisplayEngineOwnerAndChangedSession (0.20s) +FAIL +FAIL wootc 0.219s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go-b6.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go-b6.raw.log new file mode 100644 index 00000000..d7a5f392 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go-b6.raw.log @@ -0,0 +1,5 @@ +ok wootc 6.900s +ok wootc/internal/artifactauth 0.038s +ok wootc/internal/runtimebundle 0.106s +ok wootc/tools/gendto 0.010s +ok wootc/tools/signmanifest 0.011s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go21dd.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go21dd.raw.log new file mode 100644 index 00000000..28612d36 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/full-go21dd.raw.log @@ -0,0 +1,5 @@ +ok wootc 9.589s +ok wootc/internal/artifactauth 0.063s +ok wootc/internal/runtimebundle 0.175s +ok wootc/tools/gendto 0.020s +ok wootc/tools/signmanifest 0.022s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/guard-mutations.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/guard-mutations.json new file mode 100644 index 00000000..aac62bba --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/guard-mutations.json @@ -0,0 +1,107 @@ +[ + { + "case": "missing-return", + "exit": 1, + "sourceFile": "app/vm_qmp.go", + "productionSha256": "1a434e11459306dafc415eac323e98f4c3f5d8a2b1ee94bfb9568dcdfe12e66f", + "mutantSha256": "47f313ce817dd1ca7ba3f61903408d1572a986e9ce1d7acc888994ad909beb9e", + "behaviorFailureObserved": "invalid response accepted", + "test": "TestQMPTypedResponseCounterexamples", + "replacements": [ + [ + "hasReturn == hasError || len(fields) != 2", + "(hasReturn && hasError)" + ] + ] + }, + { + "case": "session-correlation", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "745b1b87227e49777fdbf31bfbd96d79b63bd3a552e8b8c0eafecfd6fe6650d6", + "behaviorFailureObserved": "accepted", + "test": "TestVMDisplayIdentityAndReplayRefuseBeforeGuest", + "replacements": [ + [ + "req.SessionID != s.sessionID", + "false" + ] + ] + }, + { + "case": "running-observation", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "81c5f2779dd8d587445894ed0ee482d1040429846912f2d090751f89629e597e", + "behaviorFailureObserved": "failed observation accepted", + "test": "TestVMDisplayUnknownOrFailedObservations", + "replacements": [ + [ + " || !*r.Running || r.Status != \"running\"", + "" + ] + ] + }, + { + "case": "capture-pixels", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "7e4e71eb74fcc14e9833121558fa6116d5ce48479127ab02d7044a9b8625a34d", + "behaviorFailureObserved": "failed observation accepted", + "test": "TestVMDisplayUnknownOrFailedObservations", + "replacements": [ + [ + "n, err := io.Copy(io.Discard, r)\n\tif err != nil || n != int64(width)*int64(height)*3", + "_, err = io.Copy(io.Discard, r)\n\tif err != nil" + ] + ] + }, + { + "case": "capture-budget-before-qmp", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "d7209573213e5fc74bffb49b8efdfaf60e5e7d46ecb883160ed47e446fc0a0be", + "behaviorFailureObserved": "exhausted budget reached QMP", + "test": "TestVMDisplayCaptureRetentionExhaustion", + "replacements": [ + [ + "\tif req.Action == \"capture\" {\n\t\tif _, count, bytes, err := s.captureInventory(); err != nil {\n\t\t\treturn out, err\n\t\t} else if count >= vmCaptureCountLimit || bytes >= vmCaptureBytesLimit {\n\t\t\treturn out, fmt.Errorf(\"retained capture budget exhausted\")\n\t\t}\n\t}", + "" + ] + ] + }, + { + "case": "engine-owner-after-response", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "7609178e920535bc5718ca24f725b830de9e68421cafcf459d11f4d8773548d5", + "behaviorFailureObserved": "changed engine owner accepted stale session response", + "test": "TestVMDisplayEngineOwnerAndChangedSession", + "replacements": [ + [ + "if !same {", + "if false && !same {" + ] + ] + }, + { + "case": "actual-retained-bytes", + "exit": 1, + "sourceFile": "app/vm_display.go", + "productionSha256": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "mutantSha256": "a7178f6a100e7b7fadf81c144ac7a3de0a0a74775121dca739c425e052246472", + "behaviorFailureObserved": "actual file bytes not measured", + "test": "TestVMDisplayActualRetainedByteBudget", + "replacements": [ + [ + "retained += info.Size()", + "retained += 0" + ] + ] + } +] diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-after.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-after.raw.log new file mode 100644 index 00000000..4feda177 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-after.raw.log @@ -0,0 +1,4 @@ +=== RUN TestVMDisplayNeverInheritsDesktopClaim +--- PASS: TestVMDisplayNeverInheritsDesktopClaim (0.02s) +PASS +ok wootc 0.029s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-before.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-before.raw.log new file mode 100644 index 00000000..1fbf6946 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/inherited-desktop-before.raw.log @@ -0,0 +1,6 @@ +=== RUN TestVMDisplayNeverInheritsDesktopClaim + vm_display_test.go:431: incoming state became live desktop proof without guest semantics +--- FAIL: TestVMDisplayNeverInheritsDesktopClaim (0.02s) +FAIL +FAIL wootc 0.021s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/initial-race-fixture-deadline.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/initial-race-fixture-deadline.raw.log new file mode 100644 index 00000000..c7b535b4 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/initial-race-fixture-deadline.raw.log @@ -0,0 +1,76 @@ +=== RUN TestVMDisplayChild +--- PASS: TestVMDisplayChild (0.00s) +=== RUN TestVMDisplayActionsAndSessionNonce +--- PASS: TestVMDisplayActionsAndSessionNonce (0.09s) +=== RUN TestVMDisplayIdentityAndReplayRefuseBeforeGuest +--- PASS: TestVMDisplayIdentityAndReplayRefuseBeforeGuest (0.04s) +=== RUN TestVMDisplayUnknownOrFailedObservations +=== RUN TestVMDisplayUnknownOrFailedObservations/paused +=== RUN TestVMDisplayUnknownOrFailedObservations/fake-status +=== RUN TestVMDisplayUnknownOrFailedObservations/ambiguous-mice +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-pixels +=== RUN TestVMDisplayUnknownOrFailedObservations/missing-capture +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-key-ack +--- PASS: TestVMDisplayUnknownOrFailedObservations (0.21s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/paused (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/fake-status (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/ambiguous-mice (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-pixels (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/missing-capture (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-key-ack (0.03s) +=== RUN TestVMDisplayKeyValidation +--- PASS: TestVMDisplayKeyValidation (0.00s) +=== RUN TestVMDisplayDeadlineAndLifecycle +--- PASS: TestVMDisplayDeadlineAndLifecycle (0.08s) +=== RUN TestVMDisplaySymlinkCaptureParentRefused +--- PASS: TestVMDisplaySymlinkCaptureParentRefused (0.04s) +=== RUN TestVMDisplayEngineOwnerAndChangedSession +--- PASS: TestVMDisplayEngineOwnerAndChangedSession (0.04s) +=== RUN TestVMDisplayForceRemainsAvailableDuringShutdownWait +--- PASS: TestVMDisplayForceRemainsAvailableDuringShutdownWait (0.04s) +=== RUN TestVMDisplayCaptureRetentionExhaustion + vm_display_test.go:336: Linux has not completed shutdown; its disk remains locked: context deadline exceeded +--- FAIL: TestVMDisplayCaptureRetentionExhaustion (1.05s) +=== RUN TestVMDisplayActualRetainedByteBudget +--- PASS: TestVMDisplayActualRetainedByteBudget (0.03s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (2.30s) + --- PASS: TestManagedVMShutdownContract/clean (1.04s) + --- PASS: TestManagedVMShutdownContract/host (1.04s) + --- PASS: TestManagedVMShutdownContract/crash (0.04s) + --- PASS: TestManagedVMShutdownContract/hung (0.18s) +=== RUN TestQMPNativePausedComponent + vm_qmp_native_test.go:27: QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18) + Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers + vm_qmp_native_test.go:49: actual paused status {"status": "prelaunch", "singlestep": false, "running": false} + vm_qmp_native_test.go:61: actual native PPM 640x480 sha256=15e7d086f38e02fb3b8af538b68d76619b0ecf56927333e1ba7510e79346fb03 +--- PASS: TestQMPNativePausedComponent (0.09s) +=== RUN TestQMPTypedResponseCounterexamples +=== RUN TestQMPTypedResponseCounterexamples/{"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} +=== RUN TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} +--- PASS: TestQMPTypedResponseCounterexamples (0.01s) + --- PASS: TestQMPTypedResponseCounterexamples/{"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) +=== RUN TestQMPBoundedBlockedWriteAndUnsupportedCommand +--- PASS: TestQMPBoundedBlockedWriteAndUnsupportedCommand (0.03s) +=== RUN TestQMPDuplicateOrMalformedJSON +--- PASS: TestQMPDuplicateOrMalformedJSON (0.00s) +=== RUN TestQMPRejectsMissingGreetingPromptly +--- PASS: TestQMPRejectsMissingGreetingPromptly (0.00s) +FAIL +FAIL wootc 4.080s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-counter-test.go b/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-counter-test.go new file mode 100644 index 00000000..874b496a --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-counter-test.go @@ -0,0 +1,7 @@ +package main +import("bufio";"context";"fmt";"io";"testing";"time") +func TestMissingCapabilityReturnMustRefuse(t *testing.T){ + childIn,parentIn:=io.Pipe();parentOut,childOut:=io.Pipe();defer childIn.Close();defer parentIn.Close();defer childOut.Close();defer parentOut.Close() + go func(){fmt.Fprintln(childOut,`{"QMP":{"version":{},"capabilities":[]}}`);r:=bufio.NewScanner(childIn);if r.Scan(){fmt.Fprintln(childOut,`{"id":"1"}`)}}() + ctx,cancel:=context.WithTimeout(context.Background(),time.Second);defer cancel();if _,err:=connectQMP(ctx,parentIn,parentOut);err==nil{t.Fatal("missing capability return accepted as successful negotiation")} +} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-mutant.log new file mode 100644 index 00000000..19a47f7e --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/missing-return-mutant.log @@ -0,0 +1,20 @@ +=== RUN TestQMPTypedResponseCounterexamples +=== RUN TestQMPTypedResponseCounterexamples/{"id":"2"} + vm_qmp_protocol_test.go:39: invalid response accepted +=== RUN TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} +=== RUN TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} +--- FAIL: TestQMPTypedResponseCounterexamples (0.01s) + --- FAIL: TestQMPTypedResponseCounterexamples/{"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) +FAIL +FAIL wootc 0.022s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/old-counter-provenance.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/old-counter-provenance.json new file mode 100644 index 00000000..c48f647a --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/old-counter-provenance.json @@ -0,0 +1,18 @@ +{ + "counterexample": "actual old/current connectQMP with successful-looking matching ID but missing return", + "baselineSource": "8e1c93e", + "runs": [ + { + "name": "before", + "exit": 1, + "sourceSha256": "fb4d2f441cf8d560d9f1aaa074b3e0e4c0a3f38f262f9bcdb8b8021af6400ff7", + "logSha256": "ba8d036bd7a83a6e4f69cd7d5f4c93e7524abcd63936d79a61f9fe898ab52520" + }, + { + "name": "after", + "exit": 0, + "sourceSha256": "5f1fc719954924b10d2c9941545a7f538caf2d0c77ca5acac4aae5b4671fed04", + "logSha256": "33756c0ae90328dc725bbb39ef64b7c18cdf2a08b98b00e0183b5763c25034e5" + } + ] +} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/old-missing-return.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/old-missing-return.raw.log new file mode 100644 index 00000000..41c785f5 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/old-missing-return.raw.log @@ -0,0 +1,6 @@ +=== RUN TestMissingCapabilityReturnMustRefuse + missing_return_test.go:6: missing capability return accepted as successful negotiation +--- FAIL: TestMissingCapabilityReturnMustRefuse (0.00s) +FAIL +FAIL command-line-arguments 0.012s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/prose.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/prose.log new file mode 100644 index 00000000..34648d3c --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/prose.log @@ -0,0 +1,42 @@ + 228 docs/agent-lessons.md + 227 docs/SPEC.md + 125 docs/phase2-attach-postmortem.md + 76 docs/borrowed-from-libertix.md + 70 docs/ntfs-on-linux.md + 65 docs/phase2-debug-plan.md + 64 docs/plugin-architecture.md + 62 docs/branding-and-distribution.md + 49 docs/gui-phase1-architecture.md + 46 docs/release-notes-v0.3.0-beta.md + 45 docs/manual-testing.md + 39 docs/philosophy.md + 34 docs/upstream-blessings.md + 32 docs/finish-plan.md + 31 docs/gui-walkthrough.md + 30 docs/session-migration.md + 29 docs/milestones.md + 27 docs/status.md + 24 docs/non-bootc-adoption.md + 23 docs/adr/0004-composefs-kernel-module-matching.md + 20 docs/alpha-adopter-program.md + 19 docs/branding.md + 18 docs/adr/0004-restore-vm-first-product.md + 17 docs/architecture-boundary.md + 15 docs/docs-truth-pass.md + 12 docs/adr/0002-hardware-preflight-bootc-matching.md + 12 docs/experiments/vm-helper-2026-09-26.md + 12 docs/prefilled-profile-testing.md + 9 docs/adr/0001-phase1-first-architecture.md + 9 docs/branded-walkthroughs.md + 9 CONTRIBUTING.md + 7 docs/plan.md + 6 docs/adr/0003-onedrive-files-on-demand-migration.md + 6 docs/vhdx-exploration.md + 4 docs/backend-contract.md + 4 docs/soak.md + 4 docs/systemd-boot.md + 1 docs/artifact-authentication.md + 1 docs/specs/migration-extensions.md + 1 docs/windows-state-trust.md + +1512 finding(s) across 40 file(s) diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/provenance.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/provenance.json new file mode 100644 index 00000000..25830a3b --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/provenance.json @@ -0,0 +1,62 @@ +{ + "capturedAt": "2026-09-27T15:24:30.324544+00:00", + "sourceCommit": "4cbdf3867f739d6a33585784fb7330184f80a2e2", + "GoSourceEquivalent": "b6c4c6f02c31beaa248daaaefd456e04625fb429", + "sourceBase": "8e1c93e", + "integratedMain": "347f696ef855866e2230dc4e761a1caf11609657", + "codeHashes": { + "app/vm_qmp.go": "1a434e11459306dafc415eac323e98f4c3f5d8a2b1ee94bfb9568dcdfe12e66f", + "app/vm_process.go": "e250903b5aab55e02533ca9e8c3cdea23bc1ce2f8a2cb874b6826f9af639ebde", + "app/vm_display.go": "fb0404e638d465a080ad487b41e652eed387198af380e6b2b4859f53e0644b5f", + "app/vm_display_test.go": "9bfe710c1dbac1163ed043f771ef8ad8a4652e21d254801cb7ec53c18e1e5b5a", + "app/vm_qmp_protocol_test.go": "40b3d2cfff5f524a76403aeccda11b0a13067b056302400f6305397336539bc1", + "app/vm_qmp_native_test.go": "370789730e36a215eb9e13dbc4b6d1614d4d0899ebb2dad8c9bfd133b32dac74", + ".github/workflows/vm-qmp-controls.yml": "d2f6e587b175d219f30b411b3e24b8fd5c6c137ba88481fd7e3ae5a359b92aaf", + "docs/experiments/vm-scoped-qmp-2026-09-27.md": "ac4451021b67ef21c05ecb40dde792d51af7db4f6c8cf4dc534a673be0b88852" + }, + "evidenceHashes": { + "prose.log": "9233fe5e6202ff272151a3f6374c2e9477434220cd2c52a701f060c16ad13f80", + "old-missing-return.raw.log": "ba8d036bd7a83a6e4f69cd7d5f4c93e7524abcd63936d79a61f9fe898ab52520", + "inherited-desktop-after.raw.log": "c5ad051b6ef0db183817f647ef6efb104e74ddb6e73eec80e887cb18562463c0", + "session-correlation-mutant.log": "0671031a7a4638ce85e54ea898105b63d7f4cff2633073c4ac92a1a355da7929", + "capture-budget-before-qmp-mutant.log": "36e53c29d37e751ce4b006cd6837252f31c59f87017a0d6042522e1e1d213d21", + "guard-mutations.json": "d6bbc8da0d989b84eb77f4ce2869e43cda4f8753ed8364220a4684b4e670d240", + "running-observation-mutant.log": "59c6d3bb43789ca25aac3efa6abb10bb752ecf717627bb42a4794c0ce3febfa9", + "inherited-desktop-before.raw.log": "1562ee3ddb345a34993ed60b43ac5de9c6e0c6d5c6aeb1906f7ee77fbbcc004d", + "full-go-b6.raw.log": "efe4f0895914c6fbdcc8f76db21f16a9ff3fd1af3200f924c5f1e5ea2e5f1523", + "actionlint.log": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "missing-return-counter-test.go": "06e16ee2bbb09efe8b84e7fd4d520b25bcf788f446539466639372ce6a734b0f", + "full-go21dd.raw.log": "af5b07d56923028346f45f7e3e532236e378063c3bf66a913bedb31a7c72db51", + "initial-race-fixture-deadline.raw.log": "0d18d11cd1912de9ebdf64d98d97ff08632db8143803c70de1ec907bbdc2fe1a", + "engine-owner-after-response-mutant.log": "2e930c947fdcb6f400ae366e28723693399108a298fa5d941ffd7893a0812137", + "old-counter-provenance.json": "cd93768524c26f647660f348bbc0adee26776bf68543f2f20b12c2662183b225", + "missing-return-mutant.log": "928cb8e5370d39cda5f0ce10f306a2cce87642856b1b8cc70be50ef2ec7f3ab5", + "race21dd.raw.log": "4a23a0923aac20c1b821b4a5e06daf563919912861037f652fd14c59f2a40309", + "current-missing-return.raw.log": "c1a381016d08ca30577e5f9235206fa14cc7950a087aa12b53f39f22d34ed137", + "race-b6.raw.log": "a7d65073b80a3f32e30747b1d59461ce7e9f2dcef05460388ba66673a01bba3e", + "actual-retained-bytes-mutant.log": "d03da5af1e3fd48c70921a69fed880786c06e759e0a98783ee23286362a04c9c", + "capture-pixels-mutant.log": "6f78096696b9e385b261357fed281d60c6985ccf9f38726895a2f3172913e1d8" + }, + "native": { + "binary": "/usr/bin/qemu-system-x86_64", + "binarySha256": "8a35ccba41582fc6c38b9df85fc9e35fa1d42f414d2d7d8090ee9b2f5e7c0854", + "version": "QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18)", + "scope": "paused TCG -S;128MiB;no disk/network/guest installation;protocol only" + }, + "checks": { + "focusedRace": "PASS;native required;zero skips", + "fullGo": "PASS", + "guardRemovals": 7, + "sourceChecks": { + "actionlint": 0, + "prose": 0 + }, + "EnglishBudget": 1512 + }, + "historicalProofs": { + "21dd": "immutable typed QMP/display/retention source;seven guardmutants bound to unchanged qmp/display bytes", + "b6": "adds DesktopReady false initialization and actual before/after child control", + "initialRaceFailure": "mock race binary one-second exit hook met one-second fixture deadline;fixture adjusted to three seconds,production unchanged" + }, + "scope": "internal engine operations only;test RPC adapter and guest semantic channel remain owed;no Windows/WHPX or desktop acceptance inferred;no full VM dispatch or preserved fixture change" +} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/race-b6.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/race-b6.raw.log new file mode 100644 index 00000000..60e90e2d --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/race-b6.raw.log @@ -0,0 +1,78 @@ +=== RUN TestVMDisplayChild +--- PASS: TestVMDisplayChild (0.00s) +=== RUN TestVMDisplayActionsAndSessionNonce +--- PASS: TestVMDisplayActionsAndSessionNonce (0.08s) +=== RUN TestVMDisplayIdentityAndReplayRefuseBeforeGuest +--- PASS: TestVMDisplayIdentityAndReplayRefuseBeforeGuest (0.03s) +=== RUN TestVMDisplayUnknownOrFailedObservations +=== RUN TestVMDisplayUnknownOrFailedObservations/paused +=== RUN TestVMDisplayUnknownOrFailedObservations/fake-status +=== RUN TestVMDisplayUnknownOrFailedObservations/ambiguous-mice +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-pixels +=== RUN TestVMDisplayUnknownOrFailedObservations/missing-capture +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-key-ack +--- PASS: TestVMDisplayUnknownOrFailedObservations (0.21s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/paused (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/fake-status (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/ambiguous-mice (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-pixels (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/missing-capture (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-key-ack (0.04s) +=== RUN TestVMDisplayKeyValidation +--- PASS: TestVMDisplayKeyValidation (0.00s) +=== RUN TestVMDisplayDeadlineAndLifecycle +--- PASS: TestVMDisplayDeadlineAndLifecycle (0.08s) +=== RUN TestVMDisplaySymlinkCaptureParentRefused +--- PASS: TestVMDisplaySymlinkCaptureParentRefused (0.04s) +=== RUN TestVMDisplayEngineOwnerAndChangedSession +--- PASS: TestVMDisplayEngineOwnerAndChangedSession (0.19s) +=== RUN TestVMDisplayForceRemainsAvailableDuringShutdownWait +--- PASS: TestVMDisplayForceRemainsAvailableDuringShutdownWait (0.04s) +=== RUN TestVMDisplayCaptureRetentionExhaustion +--- PASS: TestVMDisplayCaptureRetentionExhaustion (1.09s) +=== RUN TestVMDisplayActualRetainedByteBudget +--- PASS: TestVMDisplayActualRetainedByteBudget (0.04s) +=== RUN TestVMDisplayNeverInheritsDesktopClaim +--- PASS: TestVMDisplayNeverInheritsDesktopClaim (0.03s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (2.31s) + --- PASS: TestManagedVMShutdownContract/clean (1.05s) + --- PASS: TestManagedVMShutdownContract/host (1.04s) + --- PASS: TestManagedVMShutdownContract/crash (0.04s) + --- PASS: TestManagedVMShutdownContract/hung (0.19s) +=== RUN TestQMPNativePausedComponent + vm_qmp_native_test.go:27: QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18) + Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers + vm_qmp_native_test.go:49: actual paused status {"status": "prelaunch", "singlestep": false, "running": false} + vm_qmp_native_test.go:61: actual native PPM 640x480 sha256=15e7d086f38e02fb3b8af538b68d76619b0ecf56927333e1ba7510e79346fb03 +--- PASS: TestQMPNativePausedComponent (0.09s) +=== RUN TestQMPTypedResponseCounterexamples +=== RUN TestQMPTypedResponseCounterexamples/{"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} +=== RUN TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} +--- PASS: TestQMPTypedResponseCounterexamples (0.01s) + --- PASS: TestQMPTypedResponseCounterexamples/{"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) +=== RUN TestQMPBoundedBlockedWriteAndUnsupportedCommand +--- PASS: TestQMPBoundedBlockedWriteAndUnsupportedCommand (0.03s) +=== RUN TestQMPDuplicateOrMalformedJSON +--- PASS: TestQMPDuplicateOrMalformedJSON (0.00s) +=== RUN TestQMPShutdownNeedsLiteralTypedFields +--- PASS: TestQMPShutdownNeedsLiteralTypedFields (0.00s) +=== RUN TestQMPRejectsMissingGreetingPromptly +--- PASS: TestQMPRejectsMissingGreetingPromptly (0.00s) +PASS +ok wootc 5.304s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/race21dd.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/race21dd.raw.log new file mode 100644 index 00000000..f1960870 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/race21dd.raw.log @@ -0,0 +1,76 @@ +=== RUN TestVMDisplayChild +--- PASS: TestVMDisplayChild (0.00s) +=== RUN TestVMDisplayActionsAndSessionNonce +--- PASS: TestVMDisplayActionsAndSessionNonce (0.08s) +=== RUN TestVMDisplayIdentityAndReplayRefuseBeforeGuest +--- PASS: TestVMDisplayIdentityAndReplayRefuseBeforeGuest (0.04s) +=== RUN TestVMDisplayUnknownOrFailedObservations +=== RUN TestVMDisplayUnknownOrFailedObservations/paused +=== RUN TestVMDisplayUnknownOrFailedObservations/fake-status +=== RUN TestVMDisplayUnknownOrFailedObservations/ambiguous-mice +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-pixels +=== RUN TestVMDisplayUnknownOrFailedObservations/missing-capture +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-key-ack +--- PASS: TestVMDisplayUnknownOrFailedObservations (0.21s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/paused (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/fake-status (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/ambiguous-mice (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-pixels (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/missing-capture (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-key-ack (0.03s) +=== RUN TestVMDisplayKeyValidation +--- PASS: TestVMDisplayKeyValidation (0.00s) +=== RUN TestVMDisplayDeadlineAndLifecycle +--- PASS: TestVMDisplayDeadlineAndLifecycle (0.08s) +=== RUN TestVMDisplaySymlinkCaptureParentRefused +--- PASS: TestVMDisplaySymlinkCaptureParentRefused (0.03s) +=== RUN TestVMDisplayEngineOwnerAndChangedSession +--- PASS: TestVMDisplayEngineOwnerAndChangedSession (0.19s) +=== RUN TestVMDisplayForceRemainsAvailableDuringShutdownWait +--- PASS: TestVMDisplayForceRemainsAvailableDuringShutdownWait (0.04s) +=== RUN TestVMDisplayCaptureRetentionExhaustion +--- PASS: TestVMDisplayCaptureRetentionExhaustion (1.09s) +=== RUN TestVMDisplayActualRetainedByteBudget +--- PASS: TestVMDisplayActualRetainedByteBudget (0.03s) +=== RUN TestManagedVMShutdownContract +=== RUN TestManagedVMShutdownContract/clean +=== RUN TestManagedVMShutdownContract/host +=== RUN TestManagedVMShutdownContract/crash +=== RUN TestManagedVMShutdownContract/hung +--- PASS: TestManagedVMShutdownContract (2.30s) + --- PASS: TestManagedVMShutdownContract/clean (1.04s) + --- PASS: TestManagedVMShutdownContract/host (1.04s) + --- PASS: TestManagedVMShutdownContract/crash (0.04s) + --- PASS: TestManagedVMShutdownContract/hung (0.18s) +=== RUN TestQMPNativePausedComponent + vm_qmp_native_test.go:27: QEMU emulator version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.18) + Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers + vm_qmp_native_test.go:49: actual paused status {"status": "prelaunch", "singlestep": false, "running": false} + vm_qmp_native_test.go:61: actual native PPM 640x480 sha256=15e7d086f38e02fb3b8af538b68d76619b0ecf56927333e1ba7510e79346fb03 +--- PASS: TestQMPNativePausedComponent (0.10s) +=== RUN TestQMPTypedResponseCounterexamples +=== RUN TestQMPTypedResponseCounterexamples/{"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} +=== RUN TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} +=== RUN TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} +--- PASS: TestQMPTypedResponseCounterexamples (0.01s) + --- PASS: TestQMPTypedResponseCounterexamples/{"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":null,"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"2","id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{"running":true,"running":false},"id":"2"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"return":{},"id":"unknown"} (0.00s) + --- PASS: TestQMPTypedResponseCounterexamples/{"error":{"class":"GenericError","desc":"failed"},"id":"2"} (0.00s) +=== RUN TestQMPBoundedBlockedWriteAndUnsupportedCommand +--- PASS: TestQMPBoundedBlockedWriteAndUnsupportedCommand (0.03s) +=== RUN TestQMPDuplicateOrMalformedJSON +--- PASS: TestQMPDuplicateOrMalformedJSON (0.00s) +=== RUN TestQMPShutdownNeedsLiteralTypedFields +--- PASS: TestQMPShutdownNeedsLiteralTypedFields (0.00s) +=== RUN TestQMPRejectsMissingGreetingPromptly +--- PASS: TestQMPRejectsMissingGreetingPromptly (0.00s) +PASS +ok wootc 5.257s diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/running-observation-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/running-observation-mutant.log new file mode 100644 index 00000000..5bd536ec --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/running-observation-mutant.log @@ -0,0 +1,18 @@ +=== RUN TestVMDisplayUnknownOrFailedObservations +=== RUN TestVMDisplayUnknownOrFailedObservations/paused + vm_display_test.go:197: failed observation accepted +=== RUN TestVMDisplayUnknownOrFailedObservations/fake-status +=== RUN TestVMDisplayUnknownOrFailedObservations/ambiguous-mice +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-pixels +=== RUN TestVMDisplayUnknownOrFailedObservations/missing-capture +=== RUN TestVMDisplayUnknownOrFailedObservations/bad-key-ack +--- FAIL: TestVMDisplayUnknownOrFailedObservations (0.17s) + --- FAIL: TestVMDisplayUnknownOrFailedObservations/paused (0.04s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/fake-status (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/ambiguous-mice (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-pixels (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/missing-capture (0.03s) + --- PASS: TestVMDisplayUnknownOrFailedObservations/bad-key-ack (0.03s) +FAIL +FAIL wootc 0.182s +FAIL diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/session-correlation-mutant.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/session-correlation-mutant.log new file mode 100644 index 00000000..9656fe4b --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/session-correlation-mutant.log @@ -0,0 +1,6 @@ +=== RUN TestVMDisplayIdentityAndReplayRefuseBeforeGuest + vm_display_test.go:164: session accepted +--- FAIL: TestVMDisplayIdentityAndReplayRefuseBeforeGuest (0.03s) +FAIL +FAIL wootc 0.044s +FAIL From 658d665759e1be69c0306bd7c359edc78fae1c1c Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:35:13 +0000 Subject: [PATCH 32/33] Keep install receipts strict when adding VM preparation observations --- app/frontend/src/lib/e2e.js | 7 +- .../receipt-schema/provenance.json | 21 + .../wootc-495-action-receipt-controls.raw.log | 5 + .../wootc-495-c9-drive-control.json | 1 + .../wootc-495-c9-fast-failure.raw.log | 1054 +++++++++++++++++ .../wootc-495-c9-fast-provenance.json | 17 + .../wootc-495-c9-local-drive.raw.log | 16 + tests/unit/gui-drive-producer-controls.cjs | 12 +- tests/unit/test_gui_drive_receipt.py | 37 + 9 files changed, 1167 insertions(+), 3 deletions(-) create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-drive-control.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-failure.raw.log create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-provenance.json create mode 100644 docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-local-drive.raw.log diff --git a/app/frontend/src/lib/e2e.js b/app/frontend/src/lib/e2e.js index de1253d7..6bd96717 100644 --- a/app/frontend/src/lib/e2e.js +++ b/app/frontend/src/lib/e2e.js @@ -122,7 +122,7 @@ async function reportState(state, directive) { // cannot be selected (see the integrity gate in driveInstall) — the // alternative is a silent install of the default image. const wantRef = window.__e2eWantImage || ''; - await E2EDriveReport(JSON.stringify({ + const report = { schemaVersion: 1, runId: directive.runId, directiveId: directive.directiveId, @@ -136,6 +136,8 @@ async function reportState(state, directive) { selectedRef: state.selected?.imageRef || '', imageMismatch: !!(wantRef && state.screen === 'launchpad' && !window.__e2eInstallDriven && state.selected?.imageRef !== wantRef), + }; + if (directive.action === 'prepare-vm') Object.assign(report, { vmPrepareDriven: !!window.__e2ePrepareVMDriven, freshVmAvailable: !!state.freshVmCapability?.available, freshVmReason: state.freshVmCapability?.reason || '', @@ -147,7 +149,8 @@ async function reportState(state, directive) { !window.__e2ePrepareVMDriven && state.selected?.imageRef !== window.__e2eWantVMImage), vmReady: !!state.vmReady, vmProgressStage: state.vmProgress?.stage || '', - })); + }); + await E2EDriveReport(JSON.stringify(report)); } export function startE2EDrive(state) { diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json new file mode 100644 index 00000000..a70b0b67 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json @@ -0,0 +1,21 @@ +{ + "originalSource": "c9b60777cfac4f721a25994b05c78a796ab63e2f", + "runId": 36329610437, + "jobId": 108648907878, + "scope": "actual frontend module with DOM spies;strict unchanged install host validator;no real GUI or VM acceptance", + "vmPreparationFieldCount": 9, + "checks": "11 PASS;install/reboot exact twelve fields;prepare-vm nine extra fields;wrong/missing fields refused;removed action guard red", + "sourceHashes": { + "app/frontend/src/lib/e2e.js": "79d5a1e2d6f6ff3674f7961202ead5f58e8950e1c9bca2595c178af41897ba3b", + "tests/unit/gui-drive-producer-controls.cjs": "c93c2f11981d08e1c03211093fe60c88b6049387ee98ed96721c8b11e0459da1", + "tests/unit/test_gui_drive_receipt.py": "36c87879ba6a46b18c1842201cbd0d8608b7b2e6a17d1389ac5e68191efb42d4", + "tests/e2e/gui-drive-receipt.py": "b791144db47510eca70685c4c605af27e0d314f164e8993eb64f4eb012f8a337" + }, + "evidenceHashes": { + "wootc-495-c9-fast-failure.raw.log": "ca33984d448790a5ed085b55e3f0b38d2bf1190135c8dfcd09ef60bcc7846792", + "wootc-495-c9-fast-provenance.json": "adf2794adb8235a7464b6a4d9c890c44698b5e9a1a301b9f6e589e7613d71457", + "wootc-495-c9-local-drive.raw.log": "75d6e8c072b009d83e639f13a2b59fd27965a6fffd3e67837712aa365cb471e6", + "wootc-495-c9-drive-control.json": "049f4e894d0729f249592c8796281d205151c16c1a8332f23fe085939cc679db", + "wootc-495-action-receipt-controls.raw.log": "bf7d8b9b6cc3df82c41969aa874c8891ae5bb032effd96afb44aba2d4acd01ce" + } +} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log new file mode 100644 index 00000000..b2f69ec1 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log @@ -0,0 +1,5 @@ +........... +---------------------------------------------------------------------- +Ran 11 tests in 0.885s + +OK diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-drive-control.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-drive-control.json new file mode 100644 index 00000000..cb916828 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-drive-control.json @@ -0,0 +1 @@ +{"controls":8,"mismatchReceipt":{"schemaVersion":1,"runId":"current","directiveId":"1234567890abcdef1234567890abcdef","action":"install","screen":"launchpad","installDriven":false,"installBtnDisabled":false,"hint":"","progressStep":"","error":null,"selectedRef":"unrequested-default","imageMismatch":true,"vmPrepareDriven":false,"freshVmAvailable":false,"freshVmReason":"","vmPrepareButtonVisible":false,"vmPrepareButtonDisabled":null,"vmRuntimeButtonVisible":false,"vmImageMismatch":false,"vmReady":false,"vmProgressStage":""},"thrownClickReceipt":{"schemaVersion":1,"runId":"current","directiveId":"1234567890abcdef1234567890abcdef","action":"install","screen":"done","installDriven":false,"installBtnDisabled":false,"hint":"","progressStep":"armed","error":null,"selectedRef":"ghcr.io/tuna-os/yellowfin:gnome","imageMismatch":false,"vmPrepareDriven":false,"freshVmAvailable":false,"freshVmReason":"","vmPrepareButtonVisible":false,"vmPrepareButtonDisabled":null,"vmRuntimeButtonVisible":false,"vmImageMismatch":false,"vmReady":false,"vmProgressStage":""},"scope":"actual frontend module with DOM and bridge spies","installReceipt":{"schemaVersion":1,"runId":"current","directiveId":"1234567890abcdef1234567890abcdef","action":"install","screen":"done","installDriven":true,"installBtnDisabled":false,"hint":"","progressStep":"armed","error":null,"selectedRef":"ghcr.io/tuna-os/yellowfin:gnome","imageMismatch":false,"vmPrepareDriven":false,"freshVmAvailable":false,"freshVmReason":"","vmPrepareButtonVisible":false,"vmPrepareButtonDisabled":null,"vmRuntimeButtonVisible":false,"vmImageMismatch":false,"vmReady":false,"vmProgressStage":""}} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-failure.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-failure.raw.log new file mode 100644 index 00000000..72119a24 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-failure.raw.log @@ -0,0 +1,1054 @@ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4206662Z ##[group]Run bash tests/run.sh fast +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4206987Z ^[[36;1mbash tests/run.sh fast^[[0m +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4271190Z shell: /usr/bin/bash -e {0} +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4271467Z env: +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4271676Z GOTOOLCHAIN: local +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4271995Z WOOTC_COVERAGE_DIR: /home/runner/work/_temp/go-coverage +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4272458Z WOOTC_COVERAGE_BASE_SHA: 8e1c93e5a157435000cd3402dc07abdc95213081 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4272850Z ##[endgroup] +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4429177Z ══ fast tier ═════════════════════════════════════════════════════════ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:46.4429839Z ── bats unit suites (tests/unit) ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:48.8163446Z 1..645 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.0499803Z ok 1 GNOME look-apply exits 0 and writes the marker with no pins +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.1950418Z ok 2 KDE look-apply exits 0 with no pins +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.3153401Z ok 3 unknown desktop still exits 0 and records the marker (mapped=none) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.4627131Z ok 4 the once-only marker suppresses a second apply +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.4888099Z ok 5 no slurp data is a clean exit 0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.6615971Z ok 6 GNOME dock favorites built from taskbar pins (refactor regression guard) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.8222582Z ok 7 KDE panel launchers built from the same pins, targeting the task-manager applet +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:49.9756157Z ok 8 KDE favorites fall back to a default group when no appletsrc exists +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.1008808Z ok 9 XFCE is retired (X11/out of scope) — clean exit, mapped=none +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.1792075Z ok 10 look turned OFF in the chooser is skipped +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.3278736Z ok 11 a BROKEN selection helper must NOT block the migration (fail open) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.4519736Z ok 12 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.5889286Z ok 13 keeps the N newest runs and prunes the rest +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.6722322Z ok 14 serial and logs from pruned runs are preserved as evidence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.7247036Z ok 15 a failed evidence copy retains the complete source run +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.7770410Z ok 16 a successful exit without copied bytes cannot authorize deletion +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.8384915Z ok 17 failed run and evidence enumeration cannot delete old runs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.9064596Z ok 18 actual source deletion follows a verified complete text archive +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:50.9844604Z ok 19 the bulk (video) is NOT preserved — that is the point +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.0739229Z ok 20 the evidence directory is never itself pruned +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.1028389Z ok 21 an empty or missing artifacts dir is a clean no-op +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.1373824Z ok 22 fewer runs than the keep count prunes nothing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.1655309Z ok 23 retention runs on startup so a run cannot be blocked by its predecessors +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.1911880Z ok 24 preflight demands headroom for two runs, not the bare minimum for one +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.2151207Z ok 25 a hosted runner's ~114 GiB clears the requirement +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.2372174Z ok 26 the requirement is overridable for unusual hosts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.2607103Z ok 27 the cached-ISO and reuse paths keep proportional headroom +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.2825330Z ok 28 the keep count is overridable +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.3114981Z ok 29 the README timelapse only publishes green runs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.3443489Z ok 30 per-distribution walkthrough cuts survive each publish +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.3719393Z ok 31 the timelapse gives viewers time to read: 5s cards and freeze-frames +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.4043991Z ok 32 brand runs drive the BRANDED installer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.4363938Z ok 33 the exe pins its boot artifacts to its own release, never to latest +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.5569238Z ok 34 deployer accepts auto before image backend detection +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.5875520Z ok 35 E2E and Windows setup pass auto through by default +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.6268705Z ok 36 backend detection falls back to safe defaults when the probe fails or is ambiguous +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.6509589Z ok 37 current bootupd versioned EFI layout is recognized as ostree +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.6778958Z ok 38 ESP staging supports the current versioned shim and GRUB layout +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.7109221Z ok 39 ESP staging logs every selected source and fails closed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.7359314Z ok 40 initramfs regen KVER comes from the module tree that owns vmlinuz +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.7586400Z ok 41 deploy.sh uses no binaries absent from the initramfs closure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.7856685Z ok 42 filesystem defaults: xfs unsealed, ext4 sealed (btrfs blocked on #35) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.8077823Z ok 43 dracut regen failures report dracut's own output +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.8376922Z ok 44 the backend probe acquires the image before inspecting it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.8618111Z ok 45 verification does not assume the ostree 3-partition layout +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.8834299Z ok 46 a composefs deployment root is not prepared as a chroot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.9068992Z ok 47 an image with no NTFS driver fails the deploy, not Phase 2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.9329474Z ok 48 Phase 2 never ships without an NTFS driver +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.9571104Z ok 49 no unbounded podman call in the deployer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:51.9809778Z ok 50 a failed deploy puts its own log tail on the serial +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.0032662Z ok 51 the NTFS gate uses the same capability test as the injector +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.0249179Z ok 52 ntfs-3g injection acquires the image before running dnf in it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.0532795Z ok 53 ntfs-3g injection self-heals a broken rpmdb before escalating +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.0837116Z ok 54 an image without an NTFS driver is not refused when the deployer has one +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.1110803Z ok 55 no assignment in the deployer aborts on a non-matching grep or empty ls +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.1359535Z ok 56 teardown never turns a successful deploy into a failure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.1608880Z ok 57 the deployer names the command that aborts it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.2174914Z ok 58 the launchpad sends windowsLook with the install config +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.2457857Z ok 59 Wi-Fi collection runs outside the WindowsLook gate +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.2825325Z ok 60 Wi-Fi ordering assertion rejects collection moved inside the look gate +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.4307077Z ok 61 the real tree lists every brand that has not been declined +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.5961681Z ok 62 a declined project's exe drops out of the release matrix +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.6626753Z ok 63 a brand with no recorded decision is an error, not a default yes +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.7186433Z ok 64 an unrecognised status is an error, never treated as buildable +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.7908704Z ok 65 WOOTC_REQUIRE_BLESSING tightens pending brands out without a code change +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.8713932Z ok 66 a pending brand still builds, and the log says it is unblessed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:52.9060272Z ok 67 the release workflow selects brands through the gate, not a bare glob +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.1265389Z ok 68 every brand renders a complete winget manifest set +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.1827349Z ok 69 a rendered manifest never claims a permission nobody has granted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.2357209Z ok 70 the renderer refuses a brand with no record to offer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.2675945Z ok 71 no branded package is auto-submitted to winget +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.2911423Z ok 72 the README table and the records cannot drift apart +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.3808799Z ok 73 btrfs deploys bake an early modules-load.d entry into the Phase-2 initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.4095887Z ok 74 the attach hook clears the btrfs udev readiness gate without modprobe +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.4302785Z ok 75 the dracut module carries btrfs.ko and (optionally) btrfs-progs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.4641500Z ok 76 the filesystem axis reaches the deployer from every harness layer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.5089994Z ok 77 a btrfs deploy is refused when the target kernel cannot load btrfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.5350419Z ok 78 the Phase-2 emergency verdict reads the whole boot, and names the btrfs case +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.6457898Z ok 79 the Phase-2 → Windows reboot requires the guest to actually go down +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.6672378Z ok 80 ext4 stays the sealed default; btrfs works on supported kernels via opt-in +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.7424335Z ok 81 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.7663072Z ok 82 the ssh image is built BEFORE compose needs it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.7902933Z ok 83 a failed image build aborts instead of proceeding +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.8098807Z ok 84 the build is verified to have actually produced the image +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.8326129Z ok 85 compose_up_windows's return value is NOT ignored +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.8532760Z ok 86 container existence is verified even when compose reports success +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.8738217Z ok 87 the failure message names the actual cause and the fix +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.8963354Z ok 88 startup failure exits rather than falling through to the QEMU wait +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.9644978Z ok 89 the hook is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:53.9854843Z ok 90 the hook starts NO background job +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.0061148Z ok 91 no sleep-based watchdog remains in the code +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.0266580Z ok 92 no cancel_watchdog / WATCHDOG_PID machinery remains +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.0465733Z ok 93 the deployer exit status is still reported to kmsg +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.0666306Z ok 94 the failure path still reboots back to Windows +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.0853745Z ok 95 the removal is documented so it is not reintroduced +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.2028842Z ok 96 both scripts are syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.2279050Z ok 97 a kernel reboot is NOT treated as a successful deploy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.2494214Z ok 98 a kernel reboot with no verification summary fails loudly +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.2704341Z ok 99 the kernel-reboot failure explains that Phase-2 setup never ran +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.2916285Z ok 100 Windows answering QGA without completion is a failure, not a wait +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.3113840Z ok 101 the streak resets when Windows is NOT answering +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.3313135Z ok 102 the failure prints the deployer's own log, not just a verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.3523695Z ok 103 the post-fisherman verification stretch is instrumented +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.3748498Z ok 104 no staged binary is executed during the deploy any more +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.3964521Z ok 105 the dracut regen is bounded — it cannot hang the deploy forever +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.4184889Z ok 106 a regen timeout aborts rather than booting a stale initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.4380625Z ok 107 the regen announces itself before starting +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.4592465Z ok 108 both dracut regeneration paths explicitly include OSTree prepare-root +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.4822873Z ok 109 the generated initramfs guard requires wired OSTree prepare-root +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.5031810Z ok 110 the OSTree wiring guard accepts lsinitrd symlink output +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.5301268Z ok 111 the deployed chroot has a valid sticky var tmp before dracut +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.5547808Z ok 112 ostree usr-local backing directory exists before bridge installation +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.5839201Z ok 113 post-install writes use the OSTree stateroot var visible at runtime +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.6095029Z ok 114 stateroot paths need no dirname binary in the minimal initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.6436574Z ok 115 post-install payload is relabeled and Phase-3 label is verified +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.6663759Z ok 116 nonfatal Phase-2 checks are still collected into one verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.6875803Z ok 117 the collected problems are reported as one summary +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.7072467Z ok 118 a clean Phase-2 setup says so explicitly +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.7300008Z ok 119 instrumentation brackets the dracut module copy and the closure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.8142951Z ok 120 find_ldso locates the dynamic loader this deployer runs on +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.8784095Z ok 121 the closure resolves with neither ldd nor awk on PATH +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.9172393Z ok 122 the loader is preferred over ldd, so a broken ldd cannot break staging +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:54.9589273Z ok 123 a binary with no closure still reports none — no phantom loader +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.0412194Z ok 124 the fallback qemu-ga stages end-to-end with no ldd in the initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.0680297Z ok 125 no call site pipes ldd into awk any more +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.1060756Z ok 126 best-effort stagers warn, they do not [FAIL] +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.1254479Z ok 127 the initramfs also carries ldd, as the second path +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.2091928Z ok 128 deploy.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.2372766Z ok 129 the premise holds: run-e2e.sh really does kill the deploy on [FAIL] +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.2629759Z ok 130 every [FAIL] in deploy.sh terminates the deploy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.2945711Z ok 131 the scanner is not vacuous — a planted non-fatal [FAIL] is caught +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.3229625Z ok 132 a [FAIL] behind a return needs every call site to exit +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.3554897Z ok 133 the six sites this suite was written for stayed downgraded +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.5168222Z ok 134 E2E stages the GRUB configuration embedded by the application +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.5417909Z ok 135 docs point at the state file that actually exists +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.6211641Z ok 136 every C:\wootc path the docs name is one the code builds +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.6760819Z ok 137 the branded exe names the docs advertise are the ones brand.json builds +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.6990781Z ok 138 RELEASING does not claim a single published artifact +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.8839695Z ok 139 docs do not link to files that are not in the tree +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.9116187Z ok 140 no doc promises BitLocker works while the channel gate refuses it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.9343469Z ok 141 the documented default channel is the one the code defaults to +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.9612883Z ok 142 the image the docs call the alpha default is the one that gets selected +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:55.9884579Z ok 143 the free-space figure is the one the launchpad enforces +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.0150088Z ok 144 the first screen the docs quote is the one the build renders +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.0449186Z ok 145 the uninstall entry the docs name is the one the installer registers +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.0696662Z ok 146 the migration dashboard is called what the app calls it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.0982815Z ok 147 documented buttons and toggles exist in the frontend +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.1269302Z ok 148 no doc claims real-hardware verification before the ladder banks it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.1698027Z ok 149 every branded walkthrough has its four screenshots on disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.1971386Z ok 150 guide describes the explicit Windows-side Linux boot choice +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.2216778Z ok 151 guide discloses Firefox profile passwords instead of blanket secret exclusion +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.2477310Z ok 152 guide describes Windows removal as a plan without a consumer execution path +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.2807678Z ok 153 guide qualifies uninstall restoration and preserves old section anchors +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.3196074Z ok 154 release guide matches the tagged native graduation gate and its waiver +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.3465477Z ok 155 release user instructions disclose Install writes before reboot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.3728864Z ok 156 release user instructions describe Windows return and explicit Linux boot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.4003477Z ok 157 release user instructions qualify cleanup and disclose the data choice +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.4292348Z ok 158 getting started discloses preparation beyond a folder and boot entry +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.4574309Z ok 159 getting started qualifies cleanup and exposes its data choice +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.4868281Z ok 160 getting started qualifies reputation prompts instead of promising bypass +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.5128659Z ok 161 getting started distinguishes checksums from publisher identity +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.5422157Z ok 162 startup guides disclose the Windows WebView2 runtime dependency +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.5682608Z ok 163 roadmap separates native preview work from complete consumer proof +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.5941122Z ok 164 roadmap separates restoration requirement from current partial cleanup +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.6215863Z ok 165 roadmap requires a SmartScreen observation beyond a valid signature +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.6483704Z ok 166 README qualifies the VM goal against current desktop evidence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.6774723Z ok 167 README exposes preparation settings and normal Windows return +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.7061179Z ok 168 README separates cleanup from restoration and Linux data removal +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.7333191Z ok 169 README matches release graduation and its manual waiver +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.7575489Z ok 170 README qualifies browser secrets instead of a blanket exclusion +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.7850111Z ok 171 README discloses runtime and distinguishes hashes from signed manifests +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.8097392Z ok 172 E2E architecture separates historical native diagrams from current acceptance +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.8457950Z ok 173 E2E architecture follows the actual sourced runner boundaries +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.8743276Z ok 174 E2E architecture does not claim an atomic deployer menu handoff +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.8991573Z ok 175 E2E architecture distinguishes a QGA service request from a working channel +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.9330037Z ok 176 release rollback distinguishes remote withdrawal from signed local cache +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.9660211Z ok 177 manual hardware guide discloses actual preparation outside the state folder +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:56.9947468Z ok 178 manual hardware guide separates requested return and cleanup from restoration +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:57.0179745Z ok 179 manual hardware guide qualifies the legacy path instead of claiming VM-first or WinUI proof +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:57.1070931Z ok 180 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:57.1333720Z ok 181 deadline_in returns an absolute epoch in the future +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:57.1663214Z ok 182 past_deadline is false before and true after the deadline +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.2036580Z ok 183 a deadline elapses in real time even when the loop body blocks +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.2298253Z ok 184 elapsed_min_since reports whole minutes of real time +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.2585646Z ok 185 no wait loop is bound by a tick counter +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.2815717Z ok 186 the long-running loops use past_deadline +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.3035072Z ok 187 progress lines report real minutes against the real budget +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.3293202Z ok 188 the deploy budget is calibrated against real wall-clock behaviour +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.3511320Z ok 189 every QGA call is bounded by a timeout +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.3760932Z ok 190 the QGA call timeout is overridable for slow hosts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.3981931Z ok 191 Phase-2 boot failure reports actual waited time, not the nominal budget +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.4272912Z ok 192 an abort before the full cleanup trap still stamps the run-state file +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.5943457Z ok 193 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.7008714Z ok 194 fail() records to the ledger, not just stderr +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.8049206Z ok 195 a fail inside a command substitution still reaches the ledger +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.9093964Z ok 196 a fail inside a pipeline still reaches the ledger +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:27:59.9778506Z ok 197 the success banner is gated on the ledger being empty +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.0469965Z ok 198 the gate exits non-zero and says TESTS FAILED when the ledger is non-empty +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.1123209Z ok 199 the user-data check records a failure — it is the North Star assertion +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.1826460Z ok 200 Phase-2 health failures preserve the firstboot unit result before reboot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.2521501Z ok 201 a recovered ntfs3 mount error does not fail the run +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.3362765Z ok 202 a drm_panic handler registration is not a kernel panic +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.4033789Z ok 203 OEM payload transfers retry and report instead of aborting silently +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.4848269Z ok 204 a non-matching grep in a checked assignment cannot abort the run +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.5626003Z ok 205 a probe for something absent cannot print a [FAIL] that aborted nothing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.6346962Z ok 206 log helpers do not mangle Windows paths +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.7090291Z ok 207 a locked OEM payload file is force-replaced, not just unheld +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.7783844Z ok 208 the serial arms the deployer-death detector, not just the heartbeat +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.8523924Z ok 209 an unreachable Phase-2 agent is inconclusive, not proof of data loss +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:00.9219818Z ok 210 drive mode can only install the image the directive named +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.0075282Z ok 211 flake auto-retry: only harness-classified flakes are ever re-dispatched +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.0780211Z ok 212 the North Star read polls the bridge, it does not race it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.1467434Z ok 213 the refresh is gated: no trust helper, no chain changes +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.1658654Z ok 214 only a vendor directory wootc owns is touched +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.1853381Z ok 215 shim is replaced LAST, after GRUB and MokManager +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.2078855Z ok 216 the current chain is archived before anything replaces it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.2317320Z ok 217 the candidate is graded against the firmware AND the installed SBAT +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.2781860Z ok 218 SBAT is read from the .sbat section, not the first matching string +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.3037928Z ok 219 the helper and the update trigger travel into the deployment +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.3812447Z ok 220 the verifier grades all four criteria +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.4040459Z ok 221 an unsigned binary fails instead of reading as 'nothing wrong' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.4271098Z ok 222 a missing exe identity fails instead of passing by absence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.4475129Z ok 223 the expected per-brand identity comes from brand.json, not a copy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.4697394Z ok 224 an asset absent from SHA256SUMS fails rather than being skipped +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.4917087Z ok 225 a stale winget manifest fails even though the package resolved +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.5205789Z ok 226 the checklist cannot be talked into passing, and names its manual half +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.5406576Z ok 227 the elevation manifest is intact in the committed resource object +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.5666919Z ok 228 the release doc records signing blockers and per-brand resources +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.5857365Z ok 229 the PowerShell graders are actually run by the fast tier +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.7915135Z ok 230 E2E invokes go-native by absolute path under QGA's minimal PATH +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.8544319Z ok 231 go-native supplies sbin paths for GUI and QGA service environments +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:01.9279988Z ok 232 --phase3 provisions its dedicated blank target and handles none found +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.0009372Z ok 233 Phase-3 QGA uses the request-gated systemd boundary +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.0725360Z ok 234 Phase-3 dispatcher rechecks blank target before destructive gate +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.1445363Z ok 235 Phase-3 dispatcher runs NTFS shrink verification before migration +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.2302303Z ok 236 migrate --dual-boot on loopback describes the graduate stages and touches nothing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.3582259Z ok 237 migrate --dual-boot with shrink fixture shows available space and safe defaults +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.4413788Z ok 238 migrate --dual-boot with dirty NTFS fixture shows the dirty-volume diagnostic +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.5298066Z ok 239 migrate --dual-boot with no-space NTFS fixture shows the nospace diagnostic +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.6069708Z ok 240 plan when already native says nothing to graduate +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.8414560Z ok 241 check reports loopback + counts converted folders, never touches disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.9237921Z ok 242 check verifies NTFS shrinkability when layout is discoverable +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:02.9971429Z ok 243 check warns on dirty NTFS but does not hard-block +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.0651986Z ok 244 migrate --reclaim REFUSES while still on loopback +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.1346034Z ok 245 migrate --reclaim REFUSES when no folders are verified native +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.2142480Z ok 246 migrate --execute REFUSES without WOOTC_GN_ALLOW_DESTRUCTIVE=1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.2802685Z ok 247 migrate with no mode REFUSES +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.3607159Z ok 248 migrate --dual-boot (no --execute) is a dry run that touches no disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.4392589Z ok 249 Phase-3 plan uses recorded registry origin, not deployer-local derived tag +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.5064321Z ok 250 Phase-3 native install supplies the deployer-selected filesystem +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.5693260Z ok 251 Phase-3 home migration selects a partition, never the whole target disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.6437272Z ok 252 Phase-3 schedules and positively verifies the native boot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.7178885Z ok 253 migrate --reclaim dry run (native + converted) prints IRREVERSIBLE plan, no disk touched +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.7849710Z ok 254 migrate REFUSES when the Windows disk cannot be located +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:03.9247133Z ok 255 status --json on loopback: canGraduate true, canReclaim false, touches nothing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.0540553Z ok 256 status --json with shrink fixture reports ntfsShrinkable gate and safeGib +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.1786336Z ok 257 status --json native + converted folders: canReclaim true, folders listed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.2984413Z ok 258 status --json native but NO converted folders: canReclaim false (data-safety gate) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.3896115Z ok 259 migrate --to-disk REFUSES to install onto the Windows disk # skip no loop device +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.4675081Z ok 260 Phase-3 install uses fisherman podman-run mode with the origin image +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.5367834Z ok 261 Phase-3 post-install /etc writes target the deployment etc, not sysroot etc +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.6036042Z ok 262 Phase-3 recipe mirrors the running account into the native install +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.6724753Z ok 263 Phase-3 installs the /run userdata probe for the confined guest agent +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.7545005Z ok 264 the hook is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.7734324Z ok 265 say() writes to /dev/console (the only threshold-independent path) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.7919473Z ok 266 say() also emits an explicit low priority to kmsg for the journal +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.8163083Z ok 267 the hook announces entry before any early return +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.8375554Z ok 268 diagnostics never use dracut info()/warn(), which printk filters away +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.8573223Z ok 269 every failure exit states a reason +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.8777804Z ok 270 the hook reports what appeared after attach, not just that it attached +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.8981159Z ok 271 deployer log()/err() emit an explicit kmsg priority +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.9192703Z ok 272 deployer log()/err() do NOT also write to /dev/console +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.9383757Z ok 273 the low-volume Phase-2 hook DOES still write to /dev/console +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:04.9594248Z ok 274 the initramfs guard aborts the deploy when the attach service is unwired +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.0322309Z ok 275 every hosted workflow that runs containers wires in the runtime repair +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.0505461Z ok 276 the repair installs crun over /usr/bin, where podman actually looks +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.0706106Z ok 277 the repair proves a container can be created, not just that versions look right +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.0901053Z ok 278 the repair never touches self-hosted runners +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.1099378Z ok 279 the #71 arm gate defaults to empty so it can never gate the nightly +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.2312956Z ok 280 scan reports a Linux-safe username and the full name/email/locale +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.3094773Z ok 281 scan always reports the password as NOT migratable +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.3876902Z ok 282 scan finds the account picture +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.4888657Z ok 283 apply copies the account picture to ~/.face and AccountsService +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.5494889Z ok 284 apply with no account picture still succeeds (name only, no crash) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.6691719Z ok 285 scan finds the spare NTFS and the BitLocker disk, not the running disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.7418850Z ok 286 the running-disk (sda) partitions are excluded +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.8125926Z ok 287 BitLocker volume is flagged fs=bitlocker + locked=true +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.8830682Z ok 288 plain NTFS volume is fs=ntfs + locked=false, with its label +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:05.9539051Z ok 289 non-Windows filesystems (ext4) are not offered +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.0054103Z ok 290 empty disk list is a clean empty scan +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.1075845Z ok 291 deploy.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.1305435Z ok 292 wootc-firstboot-evidence is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.1579385Z ok 293 deploy.sh writes deployer-started.json and state.json = deploying right after ntfs-mounted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.1830222Z ok 294 deploy.sh writes state.json = deployed after vstage verify-complete +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.2124991Z ok 295 deploy.sh cleanup writes state.json = failed with phase on non-zero exit +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.2453266Z ok 296 deployer metadata uses the descriptor-preserving atomic writer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.2710038Z ok 297 wootc-firstboot-evidence exists and writes state.json = healthy atomically +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.2945630Z ok 298 wootc-firstboot-evidence.service is ordered after host-bind +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.3164248Z ok 299 firstboot service PATH includes the staged NTFS state writer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.3904921Z ok 300 firstboot health writer publishes readable state and evidence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.4264289Z ok 301 firstboot health writer fails when the private Windows mount is absent +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.4756298Z ok 302 firstboot does not publish its retry marker when the state write fails +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.5008915Z ok 303 first-boot evidence payload is staged by deploy.sh and shipped in module-setup.sh +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.5341550Z ok 304 deployHasCompleted stops trusting journal file alone +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.5622162Z ok 305 state.go defines all six lifecycle states +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.6271389Z ok 306 lifecycle capture retains failing exit even when stdout claims healthy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.6527583Z ok 307 lifecycle capture preserves successful output and separate empty stderr +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.7748240Z ok 308 public view is masked and read-only before publication +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.8349657Z ok 309 read-only failure never publishes the Windows view +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.8686838Z ok 310 privileged lifecycle and folder writers use the private mount +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.9128918Z ok 311 FUSE NTFS fallback keeps private writes available to root services +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:06.9671395Z ok 312 legacy kernel NTFS fallback keeps private writes available to root services +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:07.0369289Z ok 313 folder redirects cannot export installer state or the whole volume +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:07.0888076Z ok 314 a user-created folder symlink is never used as a bind destination +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:07.1476554Z ok 315 a case-sensitive uppercase installer directory is also masked +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:07.6785044Z ok 316 scan discovers present categories and defaults them ON +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:07.9783449Z ok 317 absent category is present=false and defaultOn=false +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:08.2496686Z ok 318 files category lists the actual folders found +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:08.5263266Z ok 319 wifi item reports the number of exported profiles +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:08.7978854Z ok 320 the Public profile is ignored by --all +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.0682806Z ok 321 scan with no discoverable data is a clean empty catalog (no crash) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.1494192Z ok 322 matrix covers Windows 10 and 11 Pro +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.1710076Z ok 323 Home rows are disabled until a Home-capable ISO fixture exists +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.1909115Z ok 324 matrix covers the BitLocker axis +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.2141669Z ok 325 matrix covers all three deployment backends +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.2396439Z ok 326 matrix has a phase3 case per backend flavor +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.2602116Z ok 327 host_worker threads the opts column through to run_case +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.2806743Z ok 328 phase3=on translates to --phase3 on the remote invocation +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.3049938Z ok 329 himachal has a hard ceiling of one concurrent VM +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.3323199Z ok 330 a case waits for a loaded host instead of piling onto it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.3607958Z ok 331 the matrix runs from an immutable snapshot of itself +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.3851757Z ok 332 remote cases are launched as systemd user units, not nohup +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.4054221Z ok 333 the poll reads systemd unit terminal state on abnormal death +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.4282370Z ok 334 --grep is a regex so an iteration loop can name distinct code paths +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.5151143Z ok 335 MokManager (mmx64.efi) travels with the signed boot chain +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.5541955Z ok 336 the deployer queues MOK enrollment for akmods images +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.5858293Z ok 337 MOK certs are harvested before the verify tree is unmounted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.6220590Z ok 338 MokManager is driven from inside the Phase-2 wait, on its own serial marker +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.6436494Z ok 339 the GUI warns about the one-time MokManager screen for images that need it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.6658283Z ok 340 the enrolled kernel actually gets a boot: re-arm after MokManager lands in Windows +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.6912977Z ok 341 the Windows-return marker is scanned in the consumed span, not just fresh output +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.7804804Z ok 342 run-e2e accepts --instance= and derives disjoint state from it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.8083682Z ok 343 compose volumes and container name are instance-parameterized +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.8348570Z ok 344 matrix per-slot cleanup is scoped to its own instance +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.8585347Z ok 345 matrix sizes runners instead of assuming capacity +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.8827360Z ok 346 concurrent deployer builds are serialized, artifacts written atomically +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.9221761Z ok 347 GUI-driven install path: seeds, drives the live form, rejoins normal flow +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.9477296Z ok 348 matrix poll ssh cannot eat the case queue +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:09.9731452Z ok 349 fresh runs reclaim their own disposable disk before preflight +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.0024446Z ok 350 registry mirror is an opt-in, probed hint at every layer +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.0247559Z ok 351 post-deploy parsing survives no-match greps (pipefail) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.0485611Z ok 352 a failed run tears the VM down even under --keep +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.0764303Z ok 353 setup-wootc.ps1 is single-instance (mutex) — no fresh-install OEM race +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.1621781Z ok 354 the Phase-2 boot menu says the word Windows +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.1896756Z ok 355 the Linux entry is named for the product, and stays the default +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.2176555Z ok 356 product Phase-2 boots quiet; observed runs keep the verbose consoles +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.2370309Z ok 357 product tool output never scrolls over the splash +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.2619518Z ok 358 a verified deploy re-arms the next boot — but never under E2E observation +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.2817230Z ok 359 the final splash message is only 'starting Linux' when a Linux boot is armed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.3033166Z ok 360 efibootmgr ships in the deployer initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.3289692Z ok 361 staged boot artifacts come with their manifest +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.3493838Z ok 362 something is on screen before the network is up +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.3731951Z ok 363 a wootc firmware entry can never survive in the permanent boot order +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.3965599Z ok 364 the one-shot arm retries as a unit — bootsequence included +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.4805557Z ok 365 a first-login welcome exists, is visible, and runs once +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.4991930Z ok 366 the welcome opens the migration dashboard, with a fallback that still says hello +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.5251526Z ok 367 the deployer stages the welcome as an autostart — tolerantly, and the initramfs ships it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.6216542Z ok 368 every migration payload deploy.sh stages is shipped in the initramfs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.6451352Z ok 369 every bridged home gets a Windows-drive bookmark +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.7424763Z ok 370 the Windows-drive bookmark also reaches KDE's Dolphin +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.7668665Z ok 371 the timelapse demo stages exist and can never fail a run +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:10.7953784Z ok 372 the NTFS-on-Linux doc cites code that still exists +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.5021184Z ok 373 NTFS state writer rejects forged descriptors and truncated records +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.5390113Z ok 374 firstboot never announces healthy when descriptor preservation fails +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.6266822Z ok 375 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.6456004Z ok 376 the run id is passed to the guest via wootc-config.txt +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.6700125Z ok 377 the guest stamps the run id into the completion marker, not a constant +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.6907250Z ok 378 the guest falls back safely when RunId is absent from the config +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.7114370Z ok 379 the barrier requires the marker to equal this run's id +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.7304858Z ok 380 an empty marker does NOT satisfy the barrier +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.7520119Z ok 381 the barrier no longer passes on a bare readable-file check +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.7756250Z ok 382 the OEM sync uses the CONTAINER's view of the mount, not a host path +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.7945848Z ok 383 C:\OEM is refreshed from the host before setup starts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.8172915Z ok 384 the OEM sync is unconditional, not limited to --skip-install +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.8417098Z ok 385 the refresh happens BEFORE the OEM script is launched +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.8624383Z ok 386 a barrier timeout distinguishes 'never completed' from 'stale marker' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.9303499Z ok 387 the deploy hook fires without a network (settled + online, one guard) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.9587377Z ok 388 a staged OCI bundle is ingested before anything network-shaped runs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:18.9820738Z ok 389 with a bundle, the registry preflight is skipped; without one, the wait is bounded and names the fix +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.0028638Z ok 390 offline deploys skip the dnf injection instead of burning its timeouts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.0308532Z ok 391 the app pre-downloads with fail-closed digest verification +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.1813725Z ok 392 both hooks are syntactically valid and safe to SOURCE +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.2098042Z ok 393 the dracut module registers both hooks under the exact expected names +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.2538579Z ok 394 the early-cpio overlay carries both hooks, and refuses to build without them +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.3385265Z ok 395 the overlay completeness gate actually rejects a hookless overlay +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.3822431Z ok 396 behavioral: nothing is staged when the host NTFS is not mounted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.4441883Z ok 397 behavioral: a Phase-2 boot stages an initramfs that systemd will pivot into +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.5152677Z ok 398 behavioral: an initramfs with no /shutdown arms nothing (fail-safe) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.5908270Z ok 399 behavioral: a staged tree carrying no umount hook is reverted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.6352537Z ok 400 behavioral: staging is skipped rather than risking OOM on a low-memory box +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.6790767Z ok 401 behavioral: an already-populated /run/initramfs is left alone +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.7216850Z ok 402 behavioral: the volume is found at the path dracut's shutdown.sh leaves it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.8022221Z ok 403 behavioral: the other post-pivot spellings are found too +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.8405393Z ok 404 behavioral: a busy volume asks to be retried instead of being abandoned +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.8869724Z ok 405 behavioral: the final pass syncs and lazy-detaches rather than leaving it mounted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:19.9198926Z ok 406 behavioral: a boot with no host NTFS mounted is a no-op, not an unmount +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.0343852Z ok 407 no early-cpio branch references the phantom /mnt/sysroot +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.0695384Z ok 408 all three prepend-cpio branches share one overlay implementation +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.0962948Z ok 409 the deployer-sourced fallback ships the loader and is exec-verified +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.1206880Z ok 410 the built Phase-2 initrd is verified by listing, not by size +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.1602293Z ok 411 a missing mountable installed root is fatal, with evidence (#45) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.2222951Z ok 412 behavioral: target ntfs-3g is staged with its libraries, symlinks intact +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.2896335Z ok 413 behavioral: fallback wrapper hardcodes the '@' argv[0] that survives switch-root +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.3731140Z ok 414 behavioral: a complete overlay + complete base initrd builds and verifies +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.4527150Z ok 415 behavioral: a base initrd without bash is REFUSED (mutation test) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.5150109Z ok 416 behavioral: an overlay with a missing wants edge is refused before packing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.7239464Z ok 417 behavioral: a microcode early-cpio does not hide the real initrd (#76) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:20.9217410Z ok 418 behavioral: a real absence is still fatal behind an early-cpio +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.1002172Z ok 419 behavioral: a microcode-only image is unverifiable, not a failure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.2357195Z ok 420 behavioral: an unlistable base initrd warns but does not fail the deploy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.3412944Z ok 421 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.3664374Z ok 422 guest-ping is OS-agnostic, so it cannot stand alone as a down-detector +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.3948372Z ok 423 a positive Linux discriminator exists alongside the Windows one +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.4190584Z ok 424 no agent answering is read as 'down' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.4430246Z ok 425 a Windows agent answering is read as 'windows', not as a live Phase 2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.4673850Z ok 426 a Linux agent still answering is read as 'linux' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.4914998Z ok 427 an agent that identifies as neither is read as 'unknown', never as Linux +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.5189040Z ok 428 the observation stops the moment Windows is seen, without draining the budget +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.5414784Z ok 429 system_reset in the Phase-2 return is reachable only from the 'linux' verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.5722354Z ok 430 the verdict is computed before the reset, from p2_reboot_observe +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.5951613Z ok 431 the reboot request is bounded so it cannot eat the observation window +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.6159932Z ok 432 the Windows return is still asserted with the OS discriminator afterwards +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:21.6388568Z ok 433 the old ping-only shape really would have reset run 30710282779 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.6757208Z ok 434 mutation: a reboot that does nothing must fail the final Windows-return assertion +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.7578718Z ok 435 the script is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.7939755Z ok 436 picks the blank spare disk, never the Windows disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.8272833Z ok 437 REFUSES when the only non-root disk is the Windows disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.8602514Z ok 438 a whole-disk filesystem with no partition table is NOT blank +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.8907101Z ok 439 skips nbd/loop/sr/zram even when they look empty +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.9243936Z ok 440 picks the first blank disk when several exist +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.9551619Z ok 441 no disks at all fails closed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:22.9909430Z ok 442 a blank disk listed AFTER the Windows disk is still found +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:23.3207999Z ok 443 manifest discovers categories from prefilled profile +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:23.3571901Z ok 444 VS Code configuration is preserved in prefilled profile +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:23.3945257Z ok 445 MS Office custom dictionary and templates are present in profile +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:23.4524729Z ok 446 registry programs.json includes typical apps +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:24.6288663Z ok 447 the reconnect cycle reports a channel that came back +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:25.7175360Z ok 448 the reconnect cycle claims nothing when the channel stays deaf +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:27.8316200Z ok 449 the recovery path cannot itself kill the run under set -e +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.0694517Z ok 450 the verdict lands in BOTH the ledger and the machine-readable file +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.1505961Z ok 451 channel loss is classified, not waited out +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.2318238Z ok 452 the reconnect cycle runs ONCE, and only before the verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.3149682Z ok 453 the reconnect cycle reaps stale clients before reopening +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.3945097Z ok 454 the verdict names the class and claims nothing about the product +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.5076411Z ok 455 the GUI timeout never treats live ping as a product verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.5871576Z ok 456 a channel that comes back is not a failure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.6665685Z ok 457 qga.py: a socket that will not open is TRANSPORT, not a guest exit code +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:28.7576954Z ok 458 qga.py: the reconnect cycle drains before it syncs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:37.7018682Z ok 459 the synthetic channel-kill test exists and runs in the fast tier +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:37.8252438Z ok 460 the staged agent is reachable from the booted root, not from /usr +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:37.8924047Z ok 461 the unit's ExecStart points at the file that was actually staged +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:37.9567138Z ok 462 the fallback stands down when the image ships its own agent +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.0083825Z ok 463 an unstageable closure fails loudly and leaves nothing half-installed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.0338233Z ok 464 the deployer no longer installs the agent into the shadowed /usr +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.0561907Z ok 465 the real-root stager is called from the post-install stage +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.1853730Z ok 466 all scripts are syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.2112775Z ok 467 Windows creates a PREALLOCATED raw image, not a VHDX +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.2352724Z ok 468 the image is physically allocated to prevent ntfs3 sparse I/O errors +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.2554319Z ok 469 the created size is verified, not assumed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.2758124Z ok 470 the deployer attaches with losetup --partscan +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.2996931Z ok 471 --partscan is present everywhere a loop device is attached +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.3222007Z ok 472 loop.max_part is set on the Phase-2 kernel cmdline, not just via modprobe +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.3435354Z ok 473 the verify attach is guarded like the main attach +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.3693262Z ok 474 detach uses losetup -d, not qemu-nbd --disconnect +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.3920677Z ok 475 no qemu-nbd remains in deployer CODE +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.4161490Z ok 476 the closure staging is gone entirely +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.4396325Z ok 477 the VHDX format check is gone +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.4602196Z ok 478 the boot hook attaches with losetup --partscan +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.4820860Z ok 479 the hook's failure message names losetup and the loop module +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.5062652Z ok 480 the hook calls no modprobe at all (Secure Boot lockdown), and never nbd +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.5267909Z ok 481 post-attach partitions are reported from the actual loop device +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.5488179Z ok 482 the attach mechanism is a systemd SERVICE, not just an initqueue hook +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.5772888Z ok 483 Phase-2 prefers the kernel ntfs3 mount and preserves FUSE fallback +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.5998103Z ok 484 the service is ordered before sysroot.mount and after udev +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.6217274Z ok 485 the service is WIRED into initrd-root-device.target, verified at build +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.6418931Z ok 486 module-setup falls back when systemdsystemunitdir is empty +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.6622122Z ok 487 the module depends on systemd so the unit dir exists +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.6863803Z ok 488 the initramfs guard checks the WIRED service, not the hook +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.7083509Z ok 489 the module installs losetup and the loop kernel module +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.7308317Z ok 490 the module stages NO foreign binary +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.7603589Z ok 491 the host-NTFS wait is wall-clock with an unconditional sleep +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.7845956Z ok 492 the EXIT device inventory cannot fall back to listing a directory +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.8522507Z ok 493 deploy.sh contains state writes for deploying, deployed, and failed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.8722949Z ok 494 deploy.sh contains fault injection hooks +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.8921352Z ok 495 setup-wootc.ps1 registers scheduled tasks and writes armed.json +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.9104349Z ok 496 app writes armed.json and registers recovery tasks in configureBCD +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.9288963Z ok 497 app unregisters recovery tasks on disarm and uninstall +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.9458187Z ok 498 uninstall_check asserts recovery scheduled tasks are unregistered +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:38.9683873Z ok 499 decision table covers all five verdicts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.0530400Z ok 500 matrix.tsv covers all 6 fault injection boundaries +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.0808095Z ok 501 matrix.tsv smoke tier includes critical recovery cells +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.0995804Z ok 502 run-matrix.sh threads fault= opts to --fault-inject and env var +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.1214610Z ok 503 run-e2e.sh accepts --fault-inject flag and handles recovery check +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.1460101Z ok 504 setup-wootc.ps1 supports -FaultInject parameter for all boundaries +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.1649849Z ok 505 setup-wootc.ps1 sweeps stale BCD entries for retry idempotency +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.1853475Z ok 506 deploy.sh reads wootc.fault and records failed state +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.2084283Z ok 507 assert-recovery.ps1 validates interrupted, retried, and uninstalled stages +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.2304146Z ok 508 run-recovery-matrix.sh is executable and accepts parameters +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.2508049Z ok 509 e2e-hosted.yml and e2e-matrix.yml support fault_inject +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.3068068Z ok 510 full releases hand the tag to winget-publish themselves +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.3783534Z ok 511 deploy.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.3969160Z ok 512 a dirty NTFS volume is still mountable via ntfs3 -o force +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.4254282Z ok 513 the plain read-only mount is still tried first +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.4448515Z ok 514 ntfs-3g is the last resort when the kernel driver is absent +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.4632313Z ok 515 an unmountable device is logged, never skipped silently +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.4818783Z ok 516 a mounted device without the vhdx is also logged +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.5001465Z ok 517 success reports which driver worked +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.5223502Z ok 518 the scan still fails closed when nothing carries the vhdx +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.6025585Z ok 519 the release stages a DUAL-signed shim, pinned by exact NVR +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.6236220Z ok 520 the build refuses to publish a shim that 2023-only firmware cannot launch +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.6542632Z ok 521 the exe is stamped from the extracted shim, never from a second copy of the pin +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.6753957Z ok 522 MokManager is NOT graded against the Microsoft CAs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.6983538Z ok 523 the harness proves the same shim the release ships +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.7472198Z ok 524 the extractor walks EVERY signature, not just the first +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.7698648Z ok 525 the extractor matches on the ISSUER, not the leaf subject +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.7953447Z ok 526 the preflight gates BEFORE anything is written, and only on a known mismatch +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.8186430Z ok 527 the db read is Windows-only and the dev stub gates nothing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.9159206Z ok 528 no selection file at all → everything migrates (default on) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:39.9865418Z ok 529 category explicitly ON → migrates +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.0569353Z ok 530 category explicitly OFF → skipped (this is the bug that was unwired) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.1287693Z ok 531 turning one category off does not disable the others +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.1782135Z ok 532 unreadable/corrupt selection fails open (never blocks a migration) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.3400014Z ok 533 the GUI's own default selection keeps every discovered category on +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.4411240Z ok 534 an explicitly disabled item is skipped while sibling items stay on +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.5151179Z ok 535 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.5364081Z ok 536 snapshot_serial reports failure rather than swallowing it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.5550778Z ok 537 a sustained dead feed produces a warning +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.5736962Z ok 538 the dead-feed warning states that downstream checks are untrustworthy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.5938503Z ok 539 consecutive failures are counted, and success resets the counter +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.6139840Z ok 540 the warning fires once, not on every poll +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.6395146Z ok 541 a stale PTY from a previous run is deleted before monitoring begins +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.6583645Z ok 542 the PTY-missing failure names the source it could not read +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.7418029Z ok 543 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.7610934Z ok 544 silence is measured against the serial file, not a counter +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.7815068Z ok 545 the silence threshold is generous enough for bootc install +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.8074263Z ok 546 guest CPU is sampled before any wedged verdict +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.8263015Z ok 547 high CPU during silence is reported as WORKING, not warned about +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.8449388Z ok 548 low CPU during silence is called out as wedged +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.8638365Z ok 549 a missing QEMU process is distinguished from a slow one +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.8826968Z ok 550 the CPU threshold is a real comparison, not a string test +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.9014513Z ok 551 the threshold is overridable for slow or busy hosts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.9252177Z ok 552 quiet-deploy heartbeat samples fisherman inside the guest through QGA +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.9455126Z ok 553 heartbeat is bounded and its thresholds are overridable +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.9682598Z ok 554 heartbeat cannot become success evidence or an automatic restart +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:40.9892247Z ok 555 unchanged workload counters require repeated samples before warning +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.0624025Z ok 556 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.0814597Z ok 557 the snapshot is disabled by default +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.1060471Z ok 558 the skip path still releases the OEM barrier +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.1302166Z ok 559 the skip happens BEFORE any freeze or copy +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.1487206Z ok 560 the skip is announced, not silent +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.1672569Z ok 561 it can still be re-enabled explicitly +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.1868683Z ok 562 there is still no restore path — the snapshot remains write-only +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.2467544Z ok 563 missing status CLI fails before VM setup +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.2802648Z ok 564 CLI checksum matches staged bytes and deleting binary fails again +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.3090667Z ok 565 guest checks CLI before partitioning and BCD arming +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.4079600Z ok 566 all generated step IDs, owners and labels are current +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:41.4467990Z ok 567 every phase the deployer announces is catalogued with the correct owner +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.4482747Z ok 568 real splash, firstboot and harness consumers reject label and stale-output mutations +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.5193767Z ok 569 the uninstall stage exists, opt-in, after Windows verifiably returned +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.5542096Z ok 570 every cleanup claim is asserted separately, and data preservation is one of them +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.5742645Z ok 571 the workflow can request the uninstall stage +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.6448531Z ok 572 getUninstallInfo detects partial install when wootc directory exists without root.disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.6634909Z ok 573 uninstallWith cleans up install, bundle, cache, and logs dirs on keep-root.disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.6806148Z ok 574 uninstallWith sweeps entire wootc folder when no root.disk exists or on deletion request +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.7052335Z ok 575 dedicated volume verification uses receipt policy and accepts only non-system basic NTFS partitions +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.7253812Z ok 576 partition reclaim refuses C and consumes only a receipt-bound target +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.7440397Z ok 577 uninstall verifies clean convergence and reports leftover artifacts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.7641367Z ok 578 headless uninstall command parses -delete-root-disk and -remove-partition flags +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.8488791Z ok 579 the power record is read BEFORE the folder holding it is removed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.8843122Z ok 580 the pre-install power state is mirrored where a hand-deleted folder cannot take it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.9087462Z ok 581 restoration re-enables only what was on, and reads values not substrings +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.9319072Z ok 582 only the FIRST install defines what 'prior' means +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.9527088Z ok 583 the field verifier exists and refuses to grade without a baseline +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.9753670Z ok 584 the verifier grades keep and delete against different end states +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:42.9982857Z ok 585 a missing power baseline fails the box instead of skipping it +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.0204590Z ok 586 the ESP check is two-sided: ours gone AND nothing else touched +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.0448834Z ok 587 the checklist cannot be talked into passing +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.0643714Z ok 588 the PowerShell grading logic is actually run by the fast tier +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.0895170Z ok 589 manual-testing documents the procedure the issue asks for +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.2057270Z ok 590 self-test passes +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.2548291Z ok 591 identity fields are pre-filled from the scan +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.3042494Z ok 592 prefill never carries a password field through +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.3527122Z ok 593 the password explanation is never blank +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.4013484Z ok 594 valid usernames are accepted, invalid ones explained +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.4497960Z ok 595 reserved system usernames are refused +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.4988007Z ok 596 passwords must meet the length floor and match their confirmation +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.5475157Z ok 597 validate reports every problem at once, not one at a time +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.6007313Z ok 598 the password NEVER reaches the saved account file +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.6503293Z ok 599 a future field added to the form cannot leak into the saved record +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.7018402Z ok 600 the password goes to chpasswd on stdin, never in argv +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.7510294Z ok 601 a chpasswd failure is surfaced, not silently swallowed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.8003463Z ok 602 set_password refuses empty credentials +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.8779338Z ok 603 the arm script vaults a Linux user matching the Windows profile name +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.9028110Z ok 604 user data is seeded before the deployer barrier is released +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.9267169Z ok 605 Phase-2 bridge check is a live QGA content read against RUN_ID +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.9526314Z ok 606 Phase-3 native persistence check reads the file from the native disk +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:43.9757036Z ok 607 vault user requests only the wheel group +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.0063647Z ok 608 passthrough is wanted by multi-user, after /var is mounted +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.0314707Z ok 609 Phase-3 reboot never rides the QGA channel +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.0523008Z ok 610 mount-user-dirs reports a bind verdict and flags a missing home +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.0745793Z ok 611 fisherman pins user homes into the stateroot var +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.0959298Z ok 612 emergency-shell diagnosis distinguishes attach from mount failure +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.2248986Z ok 613 WPA2-PSK profile becomes a wpa-psk NM keyfile with the passphrase +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.2925688Z ok 614 WPA3-SAE profile maps to key-mgmt=sae +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.3610439Z ok 615 open network imports with no wifi-security section +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.4225090Z ok 616 enterprise 802.1X profile is DETECTED but never copied +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.4828828Z ok 617 PSK profile with no cleartext key is skipped, not written keyless +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.5485566Z ok 618 the transient cleartext export is destroyed after import +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.6495270Z ok 619 state json records the imported/skipped counts for the dashboard +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.7153011Z ok 620 an existing NM connection is not clobbered +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.7436964Z ok 621 empty export dir is a clean no-op +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.8315711Z ok 622 picks Pro without matching Pro N or Pro Education +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.8605948Z ok 623 picks LTSC, which spells itself Enterprise LTSC +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.8894871Z ok 624 plain Enterprise never resolves to the LTSC image +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.9219921Z ok 625 an ambiguous list yields nothing rather than a coin flip +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.9513410Z ok 626 no match yields nothing, leaving Setup to decide +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:44.9788980Z ok 627 an unknown edition never guesses +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.0076922Z ok 628 surrounding whitespace in wiminfo output is tolerated +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.0403017Z ok 629 the in-run heal only fires when it can add information +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.0705196Z ok 630 the in-run heal waits for the download to settle before reading +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.1007176Z ok 631 the in-run heal never proceeds on an ambiguous list +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.1956820Z ok 632 run-e2e.sh is syntactically valid +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.2209035Z ok 633 the capture point is BEFORE any OEM/migration setup runs +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.2442959Z ok 634 prime captures via a CLEAN shutdown, never a live fsfreeze +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.2637776Z ok 635 prime waits for the guest to power off before converting +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.2886738Z ok 636 prime brings the container down before qemu-img convert +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.3081460Z ok 637 prime produces a compressed, standalone qcow2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.3277981Z ok 638 prime refuses to combine with --skip-install +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.3501978Z ok 639 prime writes the correctness key AND dockur's install markers +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.3756388Z ok 640 restore keys on the SAME formula as ANSWER_SHA (folds in bitlocker) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.4012087Z ok 641 a key MISMATCH falls back to a full install, never fails the run +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.4278699Z ok 642 a successful restore forces the --skip-install reuse path +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.4488175Z ok 643 the hosted E2E pull is best-effort (a cache miss never gates a run) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.4726304Z ok 644 the prime workflow pushes to a per-axis GHCR tag via ORAS +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.4922282Z ok 645 the hosted workflow has packages:read to pull the base image +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.6961104Z ── python unit tests (tests/unit/test_*.py) ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.6962331Z tests/unit/test_brand_adoption.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.9975204Z .... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.9975809Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.9976433Z Ran 4 tests in 0.249s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.9976658Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:45.9976766Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.0065231Z tests/unit/test_convert_directory_swap.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5482198Z ..... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5482821Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5483383Z Ran 5 tests in 0.496s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5483589Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5483708Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:46.5574129Z tests/unit/test_coverage_report.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1147556Z ......... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1148324Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1148923Z Ran 9 tests in 0.506s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1149137Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1149252Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1243846Z tests/unit/test_deployer_splash.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1985476Z .... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1985953Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1986475Z Ran 4 tests in 0.029s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1986710Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.1986821Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:28:47.2066328Z tests/unit/test_e2e_adapters.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9578626Z ................ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9579474Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9580099Z Ran 16 tests in 18.702s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9580338Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9580474Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:05.9671907Z tests/unit/test_e2e_results.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:09.0816569Z ........[FAIL] Result evidence rejected: [Errno 17] File exists: '/tmp/tmpmyk84bo2/video/.passed.nln0ewnv' -> '/tmp/tmpmyk84bo2/video/.passed' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4787098Z .......... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4787914Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4788374Z Ran 18 tests in 5.427s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4788548Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4788640Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.4941191Z tests/unit/test_esp_chain_refresh.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.5937834Z test_a_refused_candidate_leaves_the_working_chain_in_place (__main__.ChainRefresh.test_a_refused_candidate_leaves_the_working_chain_in_place) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.6699736Z test_another_linuxs_vendor_directory_on_the_same_esp_is_never_touched (__main__.ChainRefresh.test_another_linuxs_vendor_directory_on_the_same_esp_is_never_touched) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.7079489Z test_identical_chain_is_a_no_op (__main__.ChainRefresh.test_identical_chain_is_a_no_op) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.7392146Z test_no_helper_means_the_chain_is_left_alone (__main__.ChainRefresh.test_no_helper_means_the_chain_is_left_alone) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.7440819Z test_no_wootc_owned_directory_means_nothing_is_touched (__main__.ChainRefresh.test_no_wootc_owned_directory_means_nothing_is_touched) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.8218648Z test_refreshes_all_three_when_the_candidate_is_accepted (__main__.ChainRefresh.test_refreshes_all_three_when_the_candidate_is_accepted) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.8941426Z test_shim_is_written_last (__main__.ChainRefresh.test_shim_is_written_last) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9664189Z test_the_previous_chain_is_archived_before_replacement (__main__.ChainRefresh.test_the_previous_chain_is_archived_before_replacement) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9665237Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9665531Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9666080Z Ran 8 tests in 0.426s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9666287Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9666400Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:11.9755828Z tests/unit/test_gui_drive_receipt.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4244311Z ..E....... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4244856Z ====================================================================== +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4246305Z ERROR: test_actual_frontend_produces_bound_install_and_refuses_changed_identity (__main__.GuiDriveReceiptTests.test_actual_frontend_produces_bound_install_and_refuses_changed_identity) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4247904Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4248462Z Traceback (most recent call last): +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4249731Z File "/home/runner/work/wootc/wootc/tests/unit/test_gui_drive_receipt.py", line 57, in test_actual_frontend_produces_bound_install_and_refuses_changed_identity +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4251211Z receipt = json.loads(module.validate(raw, 'current', DIRECTIVE, IMAGE)) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4252455Z ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4253292Z File "/home/runner/work/wootc/wootc/tests/e2e/gui-drive-receipt.py", line 30, in validate +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4254085Z raise ValueError('invalid GUI fields') +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4254533Z ValueError: invalid GUI fields +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4254792Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4255043Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4255562Z Ran 10 tests in 0.399s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4255762Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4255888Z FAILED (errors=1) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:12.4341421Z tests/unit/test_gui_observations.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8587468Z .............. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8588493Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8589077Z Ran 14 tests in 9.376s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8589296Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8589420Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:21.8684631Z tests/unit/test_gui_session.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8389193Z ................ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8389701Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8390212Z Ran 16 tests in 2.922s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8390412Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8390527Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:24.8490452Z tests/unit/test_native_userdata_export.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1136508Z ............ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1137154Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1138093Z Ran 12 tests in 0.219s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1138352Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1138486Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.1232189Z tests/unit/test_optical_media_control.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.6983514Z ..........s. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.6984463Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.6985338Z Ran 12 tests in 0.522s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.6985792Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.6986203Z OK (skipped=1) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:25.7072650Z tests/unit/test_phase3_observations.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0764554Z ................................. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0765276Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0765898Z Ran 33 tests in 3.317s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0766123Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0766234Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:29.0875017Z tests/unit/test_plugin_import_results.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5286582Z . +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5287232Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5288132Z Ran 1 test in 1.394s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5288386Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5288532Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:30.5382170Z tests/unit/test_plugin_manifest.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5849906Z ....... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5850587Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5851621Z Ran 7 tests in 1.999s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5851885Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5852027Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.5945317Z tests/unit/test_prefilled_profile.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.6347971Z PASS (14 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:32.6397587Z tests/unit/test_qga_reconnect.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:39.4904643Z QGA: cannot open /tmp/qga-channel-kill-bga2e5hk/not-here.sock: [Errno 2] No such file or directory +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:40.4934081Z QGA reconnect: attempt 1/2: timed out +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.4950846Z QGA reconnect: attempt 2/2: timed out +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.4952868Z QGA: channel still deaf after 2 reconnect attempts — qga-channel-lost +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.4957002Z PASS (10 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5026090Z tests/unit/test_qga_write.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5463766Z PASS (3 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5524802Z tests/unit/test_recovery_guard.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5962715Z ........ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5963272Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5963935Z Ran 8 tests in 0.002s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5964181Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.5964317Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6036036Z tests/unit/test_recovery_matrix.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6498638Z .... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6499181Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6499741Z Ran 4 tests in 0.002s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6499956Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6500082Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:41.6564951Z tests/unit/test_safe_diagnostics.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3257962Z ......... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3258616Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3259147Z Ran 9 tests in 0.620s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3259331Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3259429Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3348151Z tests/unit/test_shim_trust.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3852800Z test_accepts_when_the_authorities_intersect (__main__.Decision.test_accepts_when_the_authorities_intersect) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3855978Z test_refuses_a_candidate_the_firmware_does_not_trust (__main__.Decision.test_refuses_a_candidate_the_firmware_does_not_trust) ... [wootc-shim-trust] refusing cand.efi: signed by 2023, firmware trusts 2011. Installing it would stop this machine booting Linux. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3858253Z ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3860073Z test_refuses_a_candidate_with_no_microsoft_signature (__main__.Decision.test_refuses_a_candidate_with_no_microsoft_signature) ... [wootc-shim-trust] refusing cand.efi: no Microsoft UEFI CA signature. The firmware would not launch it. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3862209Z ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3864814Z test_refuses_when_secure_boot_is_on_and_the_db_is_unreadable (__main__.Decision.test_refuses_when_secure_boot_is_on_and_the_db_is_unreadable) ... [wootc-shim-trust] refusing cand.efi: Secure Boot is on and the firmware's trust store could not be read. The chain that boots today stays. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3866305Z ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3867711Z test_secure_boot_off_skips_the_trust_check_but_not_sbat (__main__.Decision.test_secure_boot_off_skips_the_trust_check_but_not_sbat) ... [wootc-shim-trust] refusing cand.efi: SBAT generation 3 is older than the installed 7. A downgrade is what revocation blocks. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3869015Z ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3869674Z test_a_non_pe_file_raises_rather_than_guessing (__main__.ParserSafety.test_a_non_pe_file_raises_rather_than_guessing) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3870798Z test_an_unsigned_pe_reports_no_authorities (__main__.ParserSafety.test_an_unsigned_pe_reports_no_authorities) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3871893Z test_no_efivarfs_means_unknown_not_untrusted (__main__.ParserSafety.test_no_efivarfs_means_unknown_not_untrusted) ... ok +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3873445Z test_reads_a_dual_signed_shim_as_dual_signed (__main__.RealBinaries.test_reads_a_dual_signed_shim_as_dual_signed) ... skipped 'no real shim fixtures available' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3875004Z test_reads_the_sbat_generation_from_the_sbat_section (__main__.RealBinaries.test_reads_the_sbat_generation_from_the_sbat_section) ... skipped 'no real shim fixtures available' +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3875931Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3876129Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3876535Z Ran 10 tests in 0.001s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3876703Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3876807Z OK (skipped=2) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3877064Z ok cand.efi cas=2011,2023 sbat=4 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.3932724Z tests/unit/test_soak_ledger.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4661115Z ............. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4661743Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4662297Z Ran 13 tests in 0.014s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4662571Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4662681Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:42.4744774Z tests/unit/test_step_catalogue.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4734997Z ........ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4735595Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4736155Z Ran 8 tests in 0.951s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4736373Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4736490Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.4823699Z tests/unit/test_uninstall_partial.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5003159Z ── test_uninstall_partial: verifying partial-state uninstall convergence ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5004352Z [PASS] getUninstallInfo checks BCD firmware entries +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5005247Z [PASS] getUninstallInfo checks ESP artifacts +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5006158Z [PASS] getUninstallInfo checks Add/Remove registry key +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5007149Z [PASS] uninstallWith invokes ownership-aware cleanupESP +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5008283Z [PASS] uninstallWith verifies clean convergence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5008946Z [PASS] uninstallWith sweeps BCD entries +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5009545Z [PASS] uninstallWith clears one-shot bootsequence +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5010430Z [PASS] uninstallWith restores power state before directory removal +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5011514Z [PASS] assessment requires protected persistent creation receipt +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5012608Z [PASS] actual removal uses full identity and contents binding +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5013738Z [PASS] removal consumes verified object rather than drive letter +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5014832Z [PASS] backend requires positively observed deletion and extension +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5015855Z [PASS] explicit removal intent survives partial uninstall +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5016567Z [PASS] headless CLI dispatches to headlessUninstall +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5017257Z [PASS] headlessUninstall supports -delete-root-disk flag +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5018188Z [PASS] headlessUninstall supports -remove-partition flag +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5019132Z [PASS] sysprobe_windows.go supports reading power state from registry mirror +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5020129Z [PASS] sysprobe_windows.go mirrors WootcPriorHibernate in registry +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5021046Z [PASS] sysprobe_windows.go mirrors WootcPriorHiberboot in registry +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5021549Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5021713Z ALL CHECKS PASSED +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.5039977Z tests/unit/test_vm_first_host.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6147124Z .............. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6148205Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6149110Z Ran 14 tests in 0.038s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6149372Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6149584Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.6291222Z tests/unit/test_vm_helper.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8095108Z ....... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8095742Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8096411Z Ran 7 tests in 0.135s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8096667Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8096811Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.8184534Z tests/unit/test_vm_runtime_bundle.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9000232Z ... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9001319Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9001897Z Ran 3 tests in 0.016s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9002120Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9002240Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:29:43.9102619Z tests/unit/test_vm_start.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3191109Z ................... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3191725Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3192624Z Ran 19 tests in 17.359s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3192838Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3192959Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.3277089Z tests/unit/test_windows_resources.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.4164284Z go: downloading github.com/tc-hib/go-winres v0.3.3 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.8315747Z go: downloading github.com/tc-hib/winres v0.2.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:01.8321694Z go: downloading github.com/urfave/cli/v2 v2.25.7 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:02.1116286Z go: downloading github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:02.1131553Z go: downloading golang.org/x/image v0.12.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:02.6207823Z go: downloading github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:02.6208751Z go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:02.7430767Z go: downloading github.com/russross/blackfriday/v2 v2.1.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7607241Z ... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7608040Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7608569Z Ran 3 tests in 6.382s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7608765Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7608863Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:07.7703713Z tests/unit/test_windows_restart.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.0993406Z ..................... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.0994089Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.0994654Z Ran 21 tests in 7.280s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.0994864Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.0994983Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1088747Z tests/unit/test_winget_brand.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1678894Z ..... +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1679394Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1680005Z Ran 5 tests in 0.012s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1680262Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1680398Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.1743492Z tests/unit/test_wootc_package_consumer.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9782979Z ............................ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9783676Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9784240Z Ran 28 tests in 0.728s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9784502Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9784615Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:15.9925899Z tests/unit/test_workflow_safety.py +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0855474Z ........ +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0856012Z ---------------------------------------------------------------------- +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0856564Z Ran 8 tests in 0.046s +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0856774Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0856883Z OK +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:16.0943932Z ── powershell lint (tests/lint-ps1.ps1) ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.4493308Z ok app/partition-policy.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.4764845Z ok app/partition-policy.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.4854690Z ok docs/experiments/evidence/2026-09-26-vm-first/windows-whpx/wootc-phase1-bootsector-run.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.4920437Z ok docs/experiments/evidence/2026-09-26-vm-first/windows-whpx/wootc-phase1-disk-probe-run300.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.4985704Z ok docs/experiments/evidence/2026-09-26-vm-first/windows-whpx/wootc-phase1-disk-probe-run900.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5052934Z ok docs/experiments/evidence/2026-09-26-vm-first/windows-whpx/wootc-phase1-probe-run-userspaceirq.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5118804Z ok docs/experiments/evidence/2026-09-26-vm-first/windows-whpx/wootc-phase1-probe-run.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5186019Z ok docs/experiments/evidence/2026-09-26-vm-runtime/gtk-interactive-probe.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5251456Z ok docs/experiments/evidence/2026-09-26-vm-runtime/gtk-session0-probe.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5293073Z ok docs/experiments/evidence/2026-09-26-vm-runtime/gtk-task.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5362728Z ok docs/experiments/evidence/2026-09-26-vm-runtime/runtime-probe.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5384306Z ok docs/experiments/evidence/2026-09-26-vm-runtime/windows-install.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5433213Z ok docs/experiments/evidence/2026-09-27-artifact-auth/native-windows.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5525565Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5796447Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/fixture-bitlocker-diagnostics.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.5932747Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/fixture-bitlocker-key.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6058044Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/fixture-bitlocker-key.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6371210Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/fixture-bitlocker-protection.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6549618Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/fixture-bitlocker-protection.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6636668Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/failed-direct-sources/lint-ps1.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6682437Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/hostless-probe.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6775306Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6880280Z ok docs/experiments/evidence/2026-09-27-bitlocker-activation-diagnostics/prior-ancestor-mask-native/native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.6904352Z ok docs/experiments/evidence/2026-09-27-drive-receipt/native/install-command.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7006507Z ok docs/experiments/evidence/2026-09-27-drive-receipt/native/invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7028454Z ok docs/experiments/evidence/2026-09-27-drive-receipt/native/reboot-command.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7106233Z ok docs/experiments/evidence/2026-09-27-gui-handover/native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7190471Z ok docs/experiments/evidence/2026-09-27-gui-session/native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7288151Z ok docs/experiments/evidence/2026-09-27-storage-root/wootc-storage-query-native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7324830Z ok docs/experiments/evidence/2026-09-27-windows-restart/boot-query.literal.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7343918Z ok docs/experiments/evidence/2026-09-27-windows-restart/restart-request.literal.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7491187Z ok docs/experiments/evidence/2026-09-27-windows-restart/wootc-restart-native-invocation.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7538279Z ok packaging/winget/verified-tool.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.7687478Z ok tests/e2e/assert-recovery.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.8086698Z ok tests/e2e/fixture-bitlocker-diagnostics.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.8458322Z ok tests/e2e/fixture-bitlocker-key.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.8575535Z ok tests/e2e/fixture-bitlocker-key.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.8744655Z ok tests/e2e/fixture-bitlocker-protection.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.8907851Z ok tests/e2e/fixture-bitlocker-protection.tests.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9012419Z ok tests/e2e/oem/run-wootc-e2e.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9179838Z ok tests/e2e/oem/seed-profile.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9307304Z ok tests/e2e/phase1/assert-phase1.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9486899Z ok tests/e2e/seed-profile.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9890698Z ok tests/e2e/setup-wootc.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:17.9957870Z ok tests/e2e/stage-status-cli.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0044784Z ok tests/e2e/state-trust.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0104911Z ok tests/e2e/test-stage-status-cli.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0224589Z ok tests/e2e/test-state-trust.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0248315Z ok tests/e2e/windows-storage-root.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0529473Z ok tests/field/verify-fresh-machine.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0871493Z ok tests/field/verify-uninstall.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.0955473Z ok tests/lint-ps1.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1038266Z ok tests/unit/test-verified-winget-tool.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1231154Z ok tests/unit/test-verify-fresh-machine.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1395400Z ok tests/unit/test-verify-uninstall.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1402619Z PowerShell lint passed +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1916081Z ── powershell unit tests (tests/unit/test-*.ps1) ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:18.1916983Z tests/unit/test-verified-winget-tool.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:19.0443871Z PASS (8 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:19.0815430Z tests/unit/test-verify-fresh-machine.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:19.9513347Z PASS (54 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:19.9904158Z tests/unit/test-verify-uninstall.ps1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:20.8379625Z PASS (34 checks) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:20.8775409Z ── go test (fisherman TUI, cross-platform app) ── +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:20.8791042Z (created placeholder app/frontend/dist for the go:embed) +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:20.9134868Z go: downloading github.com/wailsapp/wails/v2 v2.16.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.3082720Z go: downloading golang.org/x/crypto v0.57.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.3083679Z go: downloading golang.org/x/mod v0.41.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.3458947Z go: downloading github.com/leaanthony/slicer v1.6.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.3464779Z go: downloading github.com/leaanthony/u v1.1.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.3655328Z go: downloading github.com/leaanthony/go-ansi-parser v1.6.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.4231067Z go: downloading github.com/pkg/errors v0.9.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:21.5190474Z go: downloading github.com/rivo/uniseg v0.4.7 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6028918Z ok wootc 5.905s coverage: 66.6% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6029934Z ok wootc/internal/artifactauth 0.014s coverage: 96.2% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6030748Z ok wootc/internal/runtimebundle 0.037s coverage: 82.9% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6031477Z ok wootc/tools/gendto 0.006s coverage: 86.7% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6032200Z ok wootc/tools/signmanifest 0.008s coverage: 69.8% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6589161Z go: downloading github.com/charmbracelet/bubbletea v1.3.10 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6589979Z go: downloading github.com/charmbracelet/bubbles v1.0.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.6590933Z go: downloading github.com/charmbracelet/huh v1.0.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7042485Z go: downloading github.com/charmbracelet/lipgloss v1.1.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7222162Z go: downloading github.com/charmbracelet/x/ansi v0.11.6 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7223059Z go: downloading github.com/charmbracelet/x/term v0.2.2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7224295Z go: downloading github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7325200Z go: downloading github.com/muesli/cancelreader v0.2.2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7449793Z go: downloading github.com/charmbracelet/harmonica v0.2.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7558073Z go: downloading github.com/lucasb-eyer/go-colorful v1.3.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7769226Z go: downloading github.com/muesli/termenv v0.16.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7876373Z go: downloading github.com/catppuccin/go v0.3.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.7877090Z go: downloading github.com/charmbracelet/x/cellbuf v0.0.15 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8085450Z go: downloading github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8168425Z go: downloading github.com/mitchellh/hashstructure/v2 v2.0.2 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8202212Z go: downloading golang.org/x/sys v0.38.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8466903Z go: downloading github.com/clipperhouse/displaywidth v0.9.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8648936Z go: downloading github.com/clipperhouse/uax29/v2 v2.5.0 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.8997149Z go: downloading github.com/mattn/go-runewidth v0.0.19 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9167021Z go: downloading github.com/dustin/go-humanize v1.0.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9304368Z go: downloading github.com/atotto/clipboard v0.1.4 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9403913Z go: downloading github.com/aymanbagabas/go-osc52/v2 v2.0.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9503297Z go: downloading github.com/mattn/go-isatty v0.0.20 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9525245Z go: downloading github.com/charmbracelet/colorprofile v0.4.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9607096Z go: downloading github.com/clipperhouse/stringish v0.1.1 +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:38.9656547Z go: downloading github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1055435Z github.com/projectbluefin/fisherman/tui/cmd/bootc-installer-tui coverage: 0.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1056578Z ok github.com/projectbluefin/fisherman/tui/internal/config 0.012s coverage: 90.5% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1057280Z ok github.com/projectbluefin/fisherman/tui/internal/disks 0.004s coverage: 38.9% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1064165Z github.com/projectbluefin/fisherman/tui/internal/network coverage: 0.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1065963Z ok github.com/projectbluefin/fisherman/tui/internal/sshkeys 0.022s coverage: 81.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:43.1157351Z github.com/projectbluefin/fisherman/tui/internal/tui coverage: 0.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:44.1461121Z ok github.com/tuna-os/fisherman/cmd/fisherman 0.018s coverage: 10.6% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:44.3259208Z github.com/tuna-os/fisherman/cmd/validate-overlay coverage: 0.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:47.1126544Z ok github.com/tuna-os/fisherman/internal/disk 2.957s coverage: 36.3% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:47.1127425Z github.com/tuna-os/fisherman/internal/images coverage: 0.0% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1650409Z ok github.com/tuna-os/fisherman/internal/install 3.949s coverage: 60.9% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1651681Z ok github.com/tuna-os/fisherman/internal/luks 0.004s coverage: 75.6% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1652827Z ok github.com/tuna-os/fisherman/internal/post 0.085s coverage: 52.2% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1653957Z ok github.com/tuna-os/fisherman/internal/progress 0.003s coverage: 63.6% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1655120Z ok github.com/tuna-os/fisherman/internal/recipe 0.012s coverage: 82.5% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1656270Z ok github.com/tuna-os/fisherman/internal/runner 0.007s coverage: 87.2% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.1657398Z ok github.com/tuna-os/fisherman/internal/slurp 0.053s coverage: 92.2% of statements +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2422908Z ## Measured Go coverage +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2423285Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2423549Z | Module | Covered statements | Total | Percent | +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2424141Z |---|---:|---:|---:| +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2424440Z | app | 2719 | 3976 | 68.39% | +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2424743Z | fisherman-tui | 43 | 742 | 5.80% | +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2425092Z | fisherman-core | 1806 | 3838 | 47.06% | +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2425358Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2425480Z Project: 53.39% (minimum 45%). +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2425668Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2426187Z Go statements compiled by the current OS in all configured fast-tier modules. Windows-only code is not measured by a Linux run. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2427018Z A passing report does not mean every subprocess was instrumented. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2427365Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2427840Z Changed instrumented lines: 84.63% (informational target 70%). +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2428474Z A changed instrumented line counts only if every block on it was hit. +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2428826Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2476219Z +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2476970Z ✗ fast tier FAILED +fast tier (bats + go) Run fast tier and enforce Go coverage 2026-09-27T15:30:48.2496342Z ##[error]Process completed with exit code 1. diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-provenance.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-provenance.json new file mode 100644 index 00000000..f31832bb --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-fast-provenance.json @@ -0,0 +1,17 @@ +{ + "source": "c9b60777cfac4f721a25994b05c78a796ab63e2f", + "runId": 36329610437, + "jobId": 108648907878, + "cause": "install receipt contains VM preparation fields rejected by strict install host schema", + "sourceHashes": { + "tests/unit/test_gui_drive_receipt.py": "608e748fc759f68a4c79963cadccaf74786fe7a99fd730a1da6758a4ac22c2c2", + "tests/e2e/gui-drive-receipt.py": "b791144db47510eca70685c4c605af27e0d314f164e8993eb64f4eb012f8a337", + "app/frontend/src/lib/e2e.js": "02d55c01f2b4e60c1c246b972627186e14d8cab3479ccdc1ec9da0ab3eb6f059", + "tests/unit/gui-drive-producer-controls.cjs": "b7b5e8b09825a60767dcbbfe25770ac8096ce44969ef56e3abf7bda85039b710" + }, + "evidenceHashes": { + "/tmp/wootc-495-c9-fast-failure.raw.log": "ca33984d448790a5ed085b55e3f0b38d2bf1190135c8dfcd09ef60bcc7846792", + "/tmp/wootc-495-c9-local-drive.raw.log": "75d6e8c072b009d83e639f13a2b59fd27965a6fffd3e67837712aa365cb471e6", + "/tmp/wootc-495-c9-drive-control.json": "049f4e894d0729f249592c8796281d205151c16c1a8332f23fe085939cc679db" + } +} diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-local-drive.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-local-drive.raw.log new file mode 100644 index 00000000..301b7c58 --- /dev/null +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-c9-local-drive.raw.log @@ -0,0 +1,16 @@ +..E....... +====================================================================== +ERROR: test_actual_frontend_produces_bound_install_and_refuses_changed_identity (__main__.GuiDriveReceiptTests.test_actual_frontend_produces_bound_install_and_refuses_changed_identity) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/tmp/wootc-vm-scoped-qmp/tests/unit/test_gui_drive_receipt.py", line 57, in test_actual_frontend_produces_bound_install_and_refuses_changed_identity + receipt = json.loads(module.validate(raw, 'current', DIRECTIVE, IMAGE)) + ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "/tmp/wootc-vm-scoped-qmp/tests/e2e/gui-drive-receipt.py", line 30, in validate + raise ValueError('invalid GUI fields') +ValueError: invalid GUI fields + +---------------------------------------------------------------------- +Ran 10 tests in 0.451s + +FAILED (errors=1) diff --git a/tests/unit/gui-drive-producer-controls.cjs b/tests/unit/gui-drive-producer-controls.cjs index fb755726..81ed7de4 100644 --- a/tests/unit/gui-drive-producer-controls.cjs +++ b/tests/unit/gui-drive-producer-controls.cjs @@ -7,6 +7,9 @@ const source = fs.readFileSync(process.argv[2], 'utf8').replace(/^import .*;\n/, const image = 'ghcr.io/tuna-os/yellowfin:gnome'; const identity = {schemaVersion: 1, runId: 'current', directiveId: '1234567890abcdef1234567890abcdef'}; let directive = {...identity, action: 'install', image, username: 'wootc', hostname: 'test', password: 'public-test'}; +const installFields = ['schemaVersion', 'runId', 'directiveId', 'action', 'screen', 'installDriven', 'installBtnDisabled', 'hint', 'progressStep', 'error', 'selectedRef', 'imageMismatch']; +const vmFields = ['vmPrepareDriven', 'freshVmAvailable', 'freshVmReason', 'vmPrepareButtonVisible', 'vmPrepareButtonDisabled', 'vmRuntimeButtonVisible', 'vmImageMismatch', 'vmReady', 'vmProgressStage']; +const fieldsEqual = (receipt, expected) => assert.deepEqual(Object.keys(receipt).sort(), [...expected].sort()); const reports = []; let scheduled, clicks = 0, reboots = 0, events = 0; const button = {disabled: false, click() { clicks++; }}; @@ -38,6 +41,8 @@ async function settle() { await new Promise(resolve => setImmediate(resolve)); } assert.equal(reports[0].action, 'install'); assert.equal(reports[0].installDriven, true); state.screen = 'done'; scheduled(); await settle(); assert.equal(reports.at(-1).screen, 'done'); + fieldsEqual(reports.at(-1), installFields); + const installReceipt = reports.at(-1); const count = reports.length; directive = {...directive, runId: 'stale'}; scheduled(); await settle(); assert.equal(reports.length, count); assert.equal(clicks, 1); assert.equal(reboots, 0); @@ -46,6 +51,11 @@ async function settle() { await new Promise(resolve => setImmediate(resolve)); } directive = {...identity, action: 'reboot'}; scheduled(); await settle(); assert.equal(reboots, 1); assert.equal(reports.at(-1).action, 'reboot'); scheduled(); await settle(); assert.equal(reboots, 1); + const rebootReceipt = reports.at(-1); + fieldsEqual(rebootReceipt, installFields); + await context.reportState(state, {...identity, action: 'prepare-vm'}); + const prepareReceipt = reports.at(-1); + fieldsEqual(prepareReceipt, [...installFields, ...vmFields]); // A click that throws never reports installDriven and is not replayed. const failedReports = []; let failedScheduled, failedClicks = 0; const failedContext = {...context, window: {}, @@ -77,5 +87,5 @@ async function settle() { await new Promise(resolve => setImmediate(resolve)); } assert.equal(mismatchClicks, 0); assert.equal(mismatchReports.length, 1); assert.equal(mismatchReports[0].installDriven, false); assert.equal(mismatchReports[0].imageMismatch, true); - console.log(JSON.stringify({controls: 8, mismatchReceipt: mismatchReports[0], thrownClickReceipt: failedReports[0], scope: 'actual frontend module with DOM and bridge spies', installReceipt: reports[1]})); + console.log(JSON.stringify({controls: 8, mismatchReceipt: mismatchReports[0], thrownClickReceipt: failedReports[0], scope: 'actual frontend module with DOM and bridge spies', installReceipt, rebootReceipt, prepareReceipt, receiptActionControls: 3})); })().catch(error => { console.error(error); process.exitCode = 1; }); diff --git a/tests/unit/test_gui_drive_receipt.py b/tests/unit/test_gui_drive_receipt.py index efa1254a..8b6256d3 100644 --- a/tests/unit/test_gui_drive_receipt.py +++ b/tests/unit/test_gui_drive_receipt.py @@ -79,6 +79,43 @@ def test_actual_frontend_produces_bound_install_and_refuses_changed_identity(sel self.assertNotEqual(result.returncode,0) self.assertIn('AssertionError',result.stderr) + def test_actual_producer_action_schemas_and_strict_host_refusals(self): + result = subprocess.run(['node', str(ROOT / 'tests/unit/gui-drive-producer-controls.cjs'), + str(ROOT / 'app/frontend/src/lib/e2e.js')], text=True, capture_output=True) + self.assertEqual(result.returncode, 0, result.stderr) + proof = json.loads(result.stdout) + self.assertEqual(proof['receiptActionControls'], 3) + install = proof['installReceipt'] + reboot = proof['rebootReceipt'] + prepare = proof['prepareReceipt'] + self.assertEqual(set(install), module.FIELDS) + self.assertEqual(set(reboot), module.FIELDS) + self.assertEqual(len(set(prepare) - module.FIELDS), 9) + self.assertEqual(prepare['action'], 'prepare-vm') + module.validate(json.dumps(install), 'current', DIRECTIVE, IMAGE) + for value in (reboot, prepare): + with self.assertRaises(ValueError): + module.validate(json.dumps(value), 'current', DIRECTIVE, IMAGE) + for changes in ({'vmReady': False}, {'action': 'prepare-vm'}): + with self.assertRaises(ValueError): + module.validate(json.dumps(dict(install, **changes)), 'current', DIRECTIVE, IMAGE) + for field in module.FIELDS: + missing = dict(install) + del missing[field] + with self.subTest(missing=field), self.assertRaises(ValueError): + module.validate(json.dumps(missing), 'current', DIRECTIVE, IMAGE) + # Removing the producer's action guard reintroduces the actual c9 failure. + source = (ROOT / 'app/frontend/src/lib/e2e.js').read_text() + guard = "if (directive.action === 'prepare-vm') Object.assign(report, {" + self.assertIn(guard, source) + with tempfile.TemporaryDirectory() as tmp: + mutant = Path(tmp) / 'unconditional-report.js' + mutant.write_text(source.replace(guard, 'Object.assign(report, {', 1)) + result = subprocess.run(['node', str(ROOT / 'tests/unit/gui-drive-producer-controls.cjs'), + str(mutant)], text=True, capture_output=True) + self.assertNotEqual(result.returncode, 0) + self.assertIn('AssertionError', result.stderr) + def test_actual_cli_accepts_current_consistent_install(self): result = subprocess.run(['python3', str(PARSER), RUN, DIRECTIVE, IMAGE], input=self.receipt(), text=True, capture_output=True) From aa1784cad7a9ce4e9c095b1b863e20204bb0732c Mon Sep 17 00:00:00 2001 From: James Reilly Date: Sun, 27 Sep 2026 15:36:10 +0000 Subject: [PATCH 33/33] Exercise preparation receipt through the actual drive loop --- .../receipt-schema/provenance.json | 6 +++--- .../wootc-495-action-receipt-controls.raw.log | 2 +- tests/unit/gui-drive-producer-controls.cjs | 15 +++++++++++++-- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json index a70b0b67..07eddcb9 100644 --- a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/provenance.json @@ -4,10 +4,10 @@ "jobId": 108648907878, "scope": "actual frontend module with DOM spies;strict unchanged install host validator;no real GUI or VM acceptance", "vmPreparationFieldCount": 9, - "checks": "11 PASS;install/reboot exact twelve fields;prepare-vm nine extra fields;wrong/missing fields refused;removed action guard red", + "checks": "11 PASS;actual install/reboot/prepare-vm drive loop producers;install/reboot exact twelve fields;prepare-vm nine extra fields;wrong/missing fields refused;removed action guard red", "sourceHashes": { "app/frontend/src/lib/e2e.js": "79d5a1e2d6f6ff3674f7961202ead5f58e8950e1c9bca2595c178af41897ba3b", - "tests/unit/gui-drive-producer-controls.cjs": "c93c2f11981d08e1c03211093fe60c88b6049387ee98ed96721c8b11e0459da1", + "tests/unit/gui-drive-producer-controls.cjs": "0d1f1bf2c18bc2ee80e75bf1b2e47d755cdd5eb87eea5e3a3dd563fc6b7b3bd7", "tests/unit/test_gui_drive_receipt.py": "36c87879ba6a46b18c1842201cbd0d8608b7b2e6a17d1389ac5e68191efb42d4", "tests/e2e/gui-drive-receipt.py": "b791144db47510eca70685c4c605af27e0d314f164e8993eb64f4eb012f8a337" }, @@ -16,6 +16,6 @@ "wootc-495-c9-fast-provenance.json": "adf2794adb8235a7464b6a4d9c890c44698b5e9a1a301b9f6e589e7613d71457", "wootc-495-c9-local-drive.raw.log": "75d6e8c072b009d83e639f13a2b59fd27965a6fffd3e67837712aa365cb471e6", "wootc-495-c9-drive-control.json": "049f4e894d0729f249592c8796281d205151c16c1a8332f23fe085939cc679db", - "wootc-495-action-receipt-controls.raw.log": "bf7d8b9b6cc3df82c41969aa874c8891ae5bb032effd96afb44aba2d4acd01ce" + "wootc-495-action-receipt-controls.raw.log": "ce3d2dbf79b50bf81e0d2db5e60ad8658dece2b119f8f334a9bfc30a6ff78de0" } } diff --git a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log index b2f69ec1..06ad6757 100644 --- a/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log +++ b/docs/experiments/evidence/2026-09-27-scoped-qmp/receipt-schema/wootc-495-action-receipt-controls.raw.log @@ -1,5 +1,5 @@ ........... ---------------------------------------------------------------------- -Ran 11 tests in 0.885s +Ran 11 tests in 0.822s OK diff --git a/tests/unit/gui-drive-producer-controls.cjs b/tests/unit/gui-drive-producer-controls.cjs index 81ed7de4..0a2773de 100644 --- a/tests/unit/gui-drive-producer-controls.cjs +++ b/tests/unit/gui-drive-producer-controls.cjs @@ -53,8 +53,19 @@ async function settle() { await new Promise(resolve => setImmediate(resolve)); } scheduled(); await settle(); assert.equal(reboots, 1); const rebootReceipt = reports.at(-1); fieldsEqual(rebootReceipt, installFields); - await context.reportState(state, {...identity, action: 'prepare-vm'}); - const prepareReceipt = reports.at(-1); + const prepareReports = []; let prepareClicks = 0; + const prepareContext = {...context, window: {}, + document: {...context.document, getElementById(id) { + return id === 'vm-prepare-btn' ? {disabled: false, click() { prepareClicks++; }} : null; + }}, + E2EDriveDirective: async () => JSON.stringify({...identity, action: 'prepare-vm', image, username: 'wootc', password: 'public-test'}), + E2EDriveReport: async raw => prepareReports.push(JSON.parse(raw)), + }; + vm.runInNewContext(source, prepareContext); + prepareContext.startE2EDrive({...state, screen: 'launchpad'}); await settle(); + assert.equal(prepareClicks, 1); + const prepareReceipt = prepareReports.at(-1); + assert.equal(prepareReceipt.vmPrepareDriven, true); fieldsEqual(prepareReceipt, [...installFields, ...vmFields]); // A click that throws never reports installDriven and is not replayed. const failedReports = []; let failedScheduled, failedClicks = 0;